Amazon CloudFront

A CDN that delivers web content quickly and securely from locations close to the user.

Back to glossary Go to related practice questions

In one sentence

A CDN that delivers web content quickly and securely from locations close to the user.

Overview

A CDN service that delivers content from edge locations worldwide. Delivers content quickly using S3 or ALB as origins.

Common use cases

HTTPS delivery of S3 static sites
Cache delivery for images and JavaScript
Preventing direct public access to S3

CLF-C02 exam points

A CDN service
Caching improves performance and reduces origin load
Can be used for HTTPS delivery

SAA-C03 exam points

Use OAC for private delivery with an S3 origin
Design cache TTL and invalidation
ACM certificates for CloudFront must be issued in us-east-1

Practical Use

A typical real-world configuration where CloudFront is heavily used is the "S3 + CloudFront" static site pattern. HTML, CSS, JavaScript, and images are placed in S3 and delivered via CloudFront in front. This setup eliminates the cost of a continuously running server during idle periods while delivering content with low latency to users worldwide. It is adopted across all scales — from personal portfolio sites to corporate campaign sites. For dynamic applications as well, the common pattern is to place CloudFront in front, cache static assets (images, JS, CSS) at the edge, and pass only API requests through to origins (ALB or API Gateway). This offloads delivery of unchanging assets to the edge and concentrates origin processing on requests that actually require it. Security and cost perspectives should also be kept in mind. CloudFront includes AWS Shield Standard automatically, providing standard, baseline protection against DDoS attacks. When combined with AWS WAF, application-layer protections such as IP address restrictions, rate limiting, and SQL injection mitigation can be applied at the CloudFront edge. For S3 origins, the standard design uses OAC (Origin Access Control) so that the S3 bucket is not exposed directly and accepts only access via CloudFront. On the cost side, charges are incurred per data transfer volume, HTTP request count, and per Invalidation (cache eviction), but a free tier provides 1 TB of data transfer and 10 million requests per month.

Official Documentation

Cost notes

Charged based on data transfer, request count, and invalidations
Reduce data transfer with image optimization

Security notes

Use Viewer Protocol Policy to redirect to HTTPS
Restrict S3 origins with OAC

Related services

Amazon Simple Storage Service

A representative AWS storage service for storing files securely and at low cost.

AWS Certificate Manager

Manages the certificates required for HTTPS.

Amazon Route 53

A DNS service that links domain names to AWS resources.

AWS WAF

A service that blocks unauthorized web access via rules.

Related architecture diagrams

STATIC / SITE / S3 / CLOUDFRONT