Amazon CloudFront
Amazon CloudFront is a content delivery network (CDN) service of Amazon Web Services that securely delivers content to customers worldwide with low latency, low network overhead, and high transfer speeds. It uses edge locations to cache content close to viewers and integrates with Amazon S3, Amazon EC2, and Amazon Route 53 to serve and secure that content.
AI Practitioner focus
- CloudFront can deliver static AI application content and cache appropriate public/non-sensitive responses or assets at the edge, reducing origin latency and load.
- It is a content-delivery network, not a model endpoint; never cache personalized or sensitive AI output without correct cache keys, authorization, and data controls.
Key points
- Uses Edge locations, a worldwide network of data centers, to deliver content faster.
- Without edge locations, it retrieves data from an origin such as an Amazon S3 bucket, a Media Package channel, or an HTTP server.
- Security features include:
- Field-level encryption with HTTPS — data remains encrypted throughout, starting from the upload of sensitive data.
- AWS Shield Standard — protects against DDoS attacks, automatically and at no extra cost.
- AWS Shield Advanced — adds near-real-time attack visibility and access to the AWS DDoS Response Team (DRT) for CloudFront distributions and Application Load Balancers, beyond what Shield Standard covers.
- AWS Shield Standard + AWS WAF + Amazon Route 53 — protects against more complex attacks than DDoS.
- Access-control mechanisms:
- Signed URLs — restrict access to individual files.
- Signed Cookies — provide access to multiple restricted files; use this when you do not want to change existing URLs.
- Geo Restriction — restrict access to content based on the geographic location of website viewers.
- Origin Access Control (OAC) — the current, recommended mechanism for securing an Amazon S3 origin so it cannot be reached directly via an S3 URL; it supports S3 buckets in every AWS Region, SSE-KMS-encrypted objects, and dynamic requests (
PUT/DELETE). - Origin Access Identity (OAI) — the legacy mechanism for the same purpose, a special CloudFront user associated with a distribution. AWS now describes OAI as legacy and not recommended, and recommends migrating existing distributions to OAC; OAI does not support opt-in Regions launched after December 2022 or SSE-KMS.
- CloudFront Signed URL — allows access to a path regardless of the origin; can be filtered by IP, path, date, and expiration; leverages CloudFront’s caching features.
- S3 Pre-Signed URL — issues a request as the person who pre-signed the URL.
- Integrates with Amazon S3, Amazon EC2, Elastic Load Balancing, Amazon Route 53, and AWS Elemental Media Services.
- Regional edge caches sit between edge locations and the origin, holding less-frequently-requested content longer to reduce load on the origin.
- Supports running custom code at the edge via two options: CloudFront Functions, lightweight JavaScript functions with submillisecond startup that run natively within CloudFront for high-scale, latency-sensitive customizations; and Lambda@Edge, an extension of AWS Lambda that runs Node.js or Python functions for more complex logic, published to a single Region and automatically replicated worldwide when attached to a distribution.
- Distinct from AWS Global Accelerator, which routes non-cacheable TCP/UDP traffic over AWS’s global network backbone to the nearest healthy endpoint rather than caching content at edge locations.