Mastering Edge Accelerators: AWS CloudFront and Global Performance

Learning Objectives

After studying this guide, you should be able to:

Identify the core components of a Content Delivery Network (CDN) and how they reduce latency.
Differentiate between AWS CloudFront and AWS Global Accelerator for specific use cases.
Configure appropriate origin types for CloudFront distributions, including S3 and custom HTTP origins.
Optimize cost and performance using CloudFront Price Classes and caching behaviors.
Design secure edge architectures using SSL/TLS certificates and Origin Access Control (OAC).

Key Terms & Glossary

Edge Location: A site that CloudFront uses to cache copies of your content for faster delivery to users at any global location.
Origin: The source of the content being delivered through the CDN (e.g., an S3 bucket, an EC2 instance, or an Application Load Balancer).
Distribution: A link between an origin server and a domain name, which CloudFront uses to identify where to get your content and how to deliver it.
TTL (Time to Live): A value that determines how long content stays in the cache before CloudFront forwards another request to the origin.
Cache Hit / Miss: A hit occurs when content is served directly from the edge cache; a miss occurs when the edge must fetch content from the origin.

The "Big Idea"

The "Big Idea" of edge acceleration is reducing the physical distance between data and the user. In a standard architecture, a user in Tokyo might have to request data from a server in Virginia, causing high latency due to the speed of light and network hops. By using a CDN, the content is cached in Tokyo, allowing the user to retrieve it in milliseconds rather than seconds. It effectively "cheats" the geography of the internet.

Formula / Concept Box

Feature	Amazon CloudFront	AWS Global Accelerator
Primary Goal	Caching content (Static/Dynamic)	Improving network path via Anycast IP
Traffic Type	HTTP/HTTPS	TCP/UDP (Non-HTTP included)
Mechanism	Caches content at Edge Locations	Proxies traffic through AWS Global Network
Best For	Videos, Images, Web Assets	Gaming (UDP), IoT, Multi-region Failover
Origin Types	S3, ALB, EC2, Lambda, Custom	ALB, NLB, EC2, Elastic IP

Hierarchical Outline

I. Amazon CloudFront Fundamentals
- Global Infrastructure: Utilizes hundreds of Edge Locations and Regional Edge Caches.
- Request Flow: User DNS → Route 53 → Closest Edge Location → Cache/Origin.
II. Distribution Configurations
- Web Distributions: Supports HTTP/HTTPS for standard web content.
- Legacy RTMP: (Real-Time Messaging Protocol) Used for Adobe Flash streaming (mostly deprecated in modern use).
- Behaviors: Define path patterns, allowed HTTP methods, and TTL settings.
III. Origins and Security
- S3 Origins: Integration with Origin Access Control (OAC) to prevent direct bucket access.
- Custom Origins: On-premises servers or non-AWS HTTP endpoints.
- Encryption: Integration with AWS Certificate Manager (ACM) for free SSL/TLS.
IV. Performance and Cost Optimization
- Price Classes: Class 100 (cheapest), Class 200, or Price Class All (best performance).
- Invalidation: Manually removing files from cache before TTL expires (costs apply).

Visual Anchors

The CDN Request Lifecycle

Loading Diagram...

Infrastructure Topology

\begin{tikzpicture}[node distance=2cm, every node/.style={draw, thick, rounded corners, align=center}] \node (User) [circle, fill=blue!10] {User\Device}; \node (Edge) [right of=User, xshift=2cm, fill=green!10] {CloudFront\Edge Location}; \node (Region) [right of=Edge, xshift=3cm, fill=orange!10] {AWS Region$Origin: S3/ALB)};

code

\draw[<->, >=stealth] (User) -- node[above] {Low Latency} (Edge);
\draw[<->, >=stealth, dashed] (Edge) -- node[above] {High Speed Backbone} (Region);
\draw[domain=0:2*pi, samples=20, smooth, variable=\x, blue!30, line width=1pt] plot ({\x/2-5}, {0.5*sin(\x r)});
\node at (-3, 1) {Internet Path};

\end{tikzpicture}

Definition-Example Pairs

Content Invalidation: The process of forcing CloudFront to remove a file from its cache before the TTL expires.
- Example: You update your company's logo.png but the old one is still showing for users. You run an invalidation for /logo.png so the new version is fetched immediately.
Price Class: A setting that allows you to limit the geographic scope of your distribution to save money.
- Example: A startup with customers only in Europe and North America selects "Price Class 100" to avoid the higher costs of maintaining caches in Australia or South America.
Origin Access Control (OAC): A security feature that ensures only CloudFront can access your S3 bucket, effectively "hiding" the bucket from the public internet.
- Example: Setting an S3 bucket policy to allow access only if the request comes from a specific CloudFront Distribution ID.

Worked Examples

Problem: Global Latency for a Static Website

Scenario: A company hosts a high-resolution photography portfolio in an S3 bucket in the us-west-2 (Oregon) region. Users in Australia report that images take 5-10 seconds to load.

Step-by-Step Solution:

Create a CloudFront Distribution: In the CloudFront console, select the S3 bucket as the Origin Domain.
Configure OAC: Enable Origin Access Control to ensure users cannot bypass the CDN and hit the S3 URL directly.
Set TTL: Configure a default TTL of 86,400 seconds (24 hours) since portfolio images rarely change.
Update DNS: Use Amazon Route 53 to create an Alias record pointing portfolio.com to the CloudFront distribution domain (e.g., d123.cloudfront.net).
Result: Australian users now hit an Edge Location in Sydney. The first request takes ~1 second (cache miss), but all subsequent users receive the image in <100ms (cache hit).

Checkpoint Questions

Which service would you use to provide a set of static Anycast IP addresses for a non-HTTP gaming application?
- Answer: AWS Global Accelerator.
A Solutions Architect needs to serve private video content to paid subscribers only. What CloudFront feature should they use?
- Answer: Signed URLs or Signed Cookies.
True or False: Using CloudFront increases the load on your origin server because of the added distribution layer.
- Answer: False. It decreases load by serving cached content from the edge instead of hitting the origin for every request.
Which origin type is NOT supported by CloudFront: S3 Bucket, Application Load Balancer, API Gateway, or an on-premises web server?
- Answer: All of these are supported (API Gateway via Custom Origin), though the source specifically highlights S3, ALB, and Custom Origins.

[!TIP] For the SAA-C03 exam, remember: CloudFront is for content caching (Layer 7), while Global Accelerator is for network path optimization (Layer 4).