backend / cloud aws / networking and content delivery / README.md

Amazon CloudFront

7 min read index source

Amazon CloudFront

Overview

Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds, all within a developer-friendly environment. CloudFront is integrated with AWS services to give developers and businesses an easy way to distribute content to end users with low latency, high data transfer speeds, and no minimum usage commitments.

Key Features

  • Global Content Delivery: Distribute content from edge locations worldwide
  • Multiple Origin Types: S3, ALB, EC2, Lambda@Edge, custom origins
  • Security: HTTPS, WAF integration, field-level encryption
  • Caching: Intelligent caching with customizable cache behaviors
  • Real-time Metrics: CloudWatch integration for monitoring
  • Cost Optimization: Pay only for data transfer and requests
  • Lambda@Edge: Run code at edge locations
  • Geographic Restrictions: Control access by country

Interview Topics

1. CloudFront Distribution Types

  • Web Distribution: For websites and web applications
  • RTMP Distribution: For streaming media (legacy)
  • Origin Types: S3, ALB, EC2, custom origins
  • Price Classes: Choose edge locations based on cost

2. CloudFront Components

  • Edge Locations: Global network of data centers
  • Regional Edge Caches: Intermediate caching layer
  • Origin: Source of content (S3, ALB, etc.)
  • Cache Behaviors: Rules for caching and serving content
  • Invalidations: Remove content from cache

3. Caching and Cache Behaviors

  • Cache Keys: Determine what constitutes a unique object
  • TTL Settings: Time-to-live for cached objects
  • Cache Policies: Predefined caching strategies
  • Origin Request Policies: Control requests to origin
  • Compression: Gzip compression for text-based content

4. Security Features

  • HTTPS: Encrypted content delivery
  • WAF Integration: Web application firewall
  • Field-Level Encryption: Encrypt specific fields
  • Geographic Restrictions: Block access by country
  • Signed URLs/Cookies: Secure content access

5. Lambda@Edge

  • Viewer Request: Before content is served
  • Origin Request: Before request goes to origin
  • Origin Response: After response from origin
  • Viewer Response: Before response to viewer
  • Use Cases: A/B testing, authentication, customization

Common Interview Questions

Basic Questions

  1. What is Amazon CloudFront and when would you use it?

    • Global content delivery network
    • Use for static content, dynamic content, and APIs
    • Reduces latency and improves performance
    • Reduces load on origin servers

  2. What are the different types of CloudFront distributions?

    • Web Distribution: For websites and web applications
    • RTMP Distribution: For streaming media (legacy)
    • Price Classes: Choose edge locations based on cost

  3. How do you create a CloudFront distribution?

    aws cloudfront create-distribution \
  --distribution-config file://distribution-config.json

Advanced Questions

  1. How do you configure CloudFront with S3 as origin?

    Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
          - Id: S3Origin
            DomainName: !GetAtt S3Bucket.RegionalDomainName
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOAI}"
        DefaultCacheBehavior:
          TargetOriginId: S3Origin
          ViewerProtocolPolicy: redirect-to-https
          CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad

  2. What is Lambda@Edge and how do you use it?

    • Run code at edge locations
    • Four trigger points: viewer request, origin request, origin response, viewer response
    • Use cases: A/B testing, authentication, content customization
    • Limitations: Node.js and Python runtime, 1MB function size

  3. How do you handle cache invalidation in CloudFront?

    • Use invalidation to remove content from cache
    • Wildcard invalidation for multiple objects
    • Invalidation limits and costs
    • Alternative: Use cache keys with versioning

Troubleshooting Questions

  1. What if CloudFront is not serving updated content?

    • Check cache invalidation
    • Verify cache behavior settings
    • Check origin response headers
    • Use cache keys with versioning

  2. How do you optimize CloudFront costs?

    • Choose appropriate price class
    • Optimize cache hit rates
    • Use compression
    • Monitor data transfer costs

Best Practices

1. Cache Optimization

  • Set appropriate TTL values
  • Use cache keys effectively
  • Implement cache invalidation strategy
  • Monitor cache hit rates

2. Security

  • Use HTTPS for all distributions
  • Implement WAF rules
  • Use signed URLs for private content
  • Configure geographic restrictions

3. Performance

  • Choose optimal edge locations
  • Use compression for text content
  • Optimize origin response times
  • Monitor performance metrics

4. Cost Management

  • Choose appropriate price class
  • Optimize cache hit rates
  • Monitor data transfer costs
  • Use compression to reduce bandwidth

5. Monitoring

  • Set up CloudWatch metrics
  • Monitor error rates
  • Track cache performance
  • Alert on issues

Use Cases

1. Static Content Delivery

  • Website assets (CSS, JS, images)
  • Software downloads
  • Documentation and media files
  • Global content distribution

2. Dynamic Content Acceleration

  • API acceleration
  • Dynamic website content
  • Real-time data delivery
  • Personalized content

3. Video Streaming

  • Video on demand (VOD)
  • Live streaming
  • Adaptive bitrate streaming
  • Global video distribution

4. Application Acceleration

  • Web application acceleration
  • Mobile app content delivery
  • API performance optimization
  • Real-time application data

Integration Patterns

1. S3 Integration

  • Static website hosting
  • File storage and delivery
  • Backup and archive access
  • Media content distribution

2. ALB Integration

  • Application load balancing
  • Dynamic content delivery
  • Session management
  • Health check integration

3. Lambda@Edge Integration

  • Content customization
  • Authentication and authorization
  • A/B testing
  • Real-time processing

4. WAF Integration

  • Security protection
  • DDoS mitigation
  • Bot protection
  • Geographic restrictions

Security Considerations

1. Content Security

  • Use HTTPS for all distributions
  • Implement signed URLs/cookies
  • Configure geographic restrictions
  • Use WAF for protection

2. Access Control

  • Implement proper authentication
  • Use IAM roles and policies
  • Configure origin access
  • Monitor access patterns

3. Data Protection

  • Encrypt data in transit
  • Use field-level encryption
  • Implement proper headers
  • Monitor for security threats

4. Compliance

  • Maintain audit trails
  • Implement data retention policies
  • Ensure regulatory compliance
  • Regular security assessments

Cost Optimization

1. Price Class Selection

  • Choose appropriate price class
  • Balance cost vs performance
  • Monitor usage patterns
  • Optimize edge location selection

2. Cache Optimization

  • Maximize cache hit rates
  • Use appropriate TTL values
  • Implement cache invalidation strategy
  • Monitor cache performance

3. Data Transfer Optimization

  • Use compression
  • Optimize content sizes
  • Monitor transfer costs
  • Implement efficient delivery

4. Origin Optimization

  • Optimize origin response times
  • Use appropriate origin types
  • Implement origin failover
  • Monitor origin performance

Performance Optimization

1. Latency Optimization

  • Choose optimal edge locations
  • Use regional edge caches
  • Optimize cache behaviors
  • Monitor latency metrics

2. Throughput Optimization

  • Use compression
  • Optimize content delivery
  • Implement proper headers
  • Monitor throughput metrics

3. Availability

  • Implement origin failover
  • Use multiple origins
  • Monitor availability metrics
  • Implement health checks

4. Scalability

  • Design for global scale
  • Use auto-scaling origins
  • Monitor scaling patterns
  • Implement capacity planning

Disaster Recovery

1. Origin Failover

  • Configure multiple origins
  • Implement health checks
  • Use origin groups
  • Test failover procedures

2. Geographic Distribution

  • Distribute across regions
  • Use multiple edge locations
  • Implement geographic routing
  • Monitor regional health

3. Content Backup

  • Backup origin content
  • Use cross-region replication
  • Maintain content versions
  • Test recovery procedures

4. Service Continuity

  • Monitor service health
  • Implement alerting
  • Use health checks
  • Maintain operational procedures

Migration Strategies

1. From Other CDNs

  • Map existing configurations
  • Migrate content and settings
  • Test performance and functionality
  • Implement monitoring

2. From Direct Origin Access

  • Configure CloudFront distribution
  • Update DNS settings
  • Test content delivery
  • Monitor performance

3. Application Migration

  • Integrate with new applications
  • Configure cache behaviors
  • Implement security measures
  • Test thoroughly

Common Pitfalls

1. Cache Issues

  • Incorrect TTL settings
  • Poor cache key design
  • Inadequate invalidation strategy
  • Cache miss optimization

2. Security Problems

  • Inadequate HTTPS configuration
  • Poor access control
  • Insufficient monitoring
  • Security misconfigurations

3. Performance Issues

  • Suboptimal edge location selection
  • Poor origin performance
  • Inadequate monitoring
  • Performance misconfigurations

4. Cost Management

  • Inefficient price class selection
  • Poor cache optimization
  • High data transfer costs
  • Inadequate cost monitoring

Resources

Interview angle

  • “What does a CDN actually buy you?” - lower latency from edge proximity, less origin load through caching, and TLS terminated close to the user. For a global audience the round-trip saving usually dominates everything you can do at the application layer.
  • “What is the cache key and why does it matter?” - the set of things that make a request distinct: path, plus whichever headers, cookies and query strings you include. Forwarding all cookies effectively disables caching, because every user gets a unique key. That is the most common CloudFront misconfiguration.
  • “How do you handle a deploy without stale assets?” - content-hashed filenames with long max-age and immutable, so new files have new URLs and no invalidation is needed. Invalidation is the fallback for HTML and is rate-limited and billed beyond a free allowance.
  • “How do you keep the origin private?” - Origin Access Control for S3, and a signed header or VPC origin for a load balancer, so nobody can bypass CloudFront and hit the origin directly.
  • “What runs at the edge?” - CloudFront Functions for lightweight header and URL manipulation at very low cost; Lambda@Edge when you need more runtime, network access or larger payloads.