Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
A content delivery network: copies of your files are cached at edge locations near viewers, and requests that miss go back to your origin over the AWS network.
Where CloudFront takes you5 steps, all open
Amazon CloudFront speeds up delivery of static and dynamic web content through a worldwide network of edge locations. Each request goes to the edge location with the lowest latency: if the file is cached there, it comes back at once; if not, CloudFront fetches it from your origin, such as an S3 bucket or a web server, and caches it for the next viewer.
More than a cache. A distribution also serves HTTPS with your own certificate, keeps private content private, blocks countries, fails over between origins, and runs small functions at the edge. Transfer from AWS origins to CloudFront is free.
A chain of corner shops stocked from one warehouse. You buy from the shop on your street; if it has the item, you walk out with it. If not, the shop orders it from a larger regional depot, or from the warehouse, and keeps some on the shelf for the next customer. Anything past its sell-by date is checked with the warehouse before it is sold again.
OriginEdge locationRegional edge cacheTTLSigned URL or cookieOrigin access controlDoes the request meet the cache behavior's viewer protocol policy? HTTPS only answers plain HTTP with 403.
Is the viewer's country allowed? A block list or allow list covers the whole distribution.
If this path is private, does the request carry a valid signed URL or signed cookie?
Is a fresh copy at this edge location? If not, CloudFront asks the regional edge cache, then the origin.
Pick a case to follow the request through each check.
Two origins, one domain. Cache behaviors send requests matching /api/* to the load balancer and everything else to the bucket, all under one domain name.
The bucket stays private. Origin access control signs CloudFront's requests, and the bucket policy allows only this distribution, so nobody can use S3 URLs to get around it.
The load balancer answers only CloudFront. CloudFront adds a secret custom header, the listener forwards only requests that carry it, and everything else gets a 403.
Protection at the edge. The web ACL, with Shield Standard underneath, stops attacks before they reach either origin.
HTTPS both ways. Redirect HTTP to HTTPS, or accept HTTPS only, for viewers, and use HTTPS to the origin as well.
Origin access control, not OAI. AWS recommends OAC: it works with buckets in every Region, with SSE-KMS encrypted objects, and with PUT and DELETE. An S3 website endpoint cannot use it, because it counts as a custom origin.
Signed URLs or signed cookies for private content: a URL for a single file or a client without cookies, cookies for many files without changing their URLs. Where both are present, the signed URL decides.
Geo restriction allows or blocks whole countries for the whole distribution. For part of the content, or finer than a country, use a geolocation service with signed URLs.
VPC origins. An Application Load Balancer, Network Load Balancer or EC2 instance in a private subnet can be served through CloudFront without ever facing the internet.
Data transfer out from edge locations to viewers, and HTTP and HTTPS requests, with rates that vary by geography.
Free from AWS origins. Transfer from S3, Elastic Load Balancing or API Gateway to CloudFront is not charged.
Extras: invalidations, CloudFront Functions, Lambda@Edge, real-time logs, Origin Shield and dedicated IP certificates.
Flat-rate plans bundle delivery with WAF, DDoS protection, DNS and edge compute for a monthly fee, as an alternative to paying as you go.
Prices change, so none are printed here. Check the CloudFront pricing page on aws.amazon.com.
| Service | What it does | Choose it when |
|---|---|---|
| CloudFront | Caches content at edge locations near viewers | Websites, APIs and video for viewers everywhere |
| Global Accelerator | Two static anycast IP addresses, routed over the AWS network to healthy Regional endpoints | Fixed IP addresses and instant rerouting around unhealthy endpoints |
| S3 website endpoint | Serves a public bucket directly, over HTTP | A simple public site with no CDN in front |
| Edge code | Runs on | Limits | Choose it when |
|---|---|---|---|
| CloudFront Functions | Viewer requests and responses | Submillisecond, 2 MB memory, 10 KB of code, no network | Header changes, redirects, cache keys, token checks |
| Lambda@Edge | Viewer and origin requests and responses | Up to 30 s, up to 10 GB memory on origin events, network and body access | Calls to other services, request bodies, heavier logic |
| Private content | Covers | Choose it when |
|---|---|---|
| Signed URL | One file | A download link, or clients that do not support cookies |
| Signed cookies | Many files | A members' area or a video's many segments, with URLs unchanged |
reduce latency for static content served to users worldwideCloudFront
Edge locations serve cached copies near each viewer.
users must not bypass CloudFront to read the S3 bucketOrigin access control
The bucket policy allows only the distribution, so S3 URLs stop working for viewers.
a certificate requested in eu-west-1 for the distribution's custom domainRequest it in us-east-1
CloudFront uses ACM certificates only from US East (N. Virginia).
restrict many premium files without changing their URLsSigned cookies
Signed URLs suit single files; cookies cover many at once.
block viewers in specific countriesGeo restriction
An allow or block list of countries for the whole distribution, answered with 403.
switch to a backup origin when the primary returns 5xx errorsAn origin group
CloudFront retries that request on the secondary, for GET, HEAD and OPTIONS.
users still see old files after a deploymentVersioned file names, or an invalidation
AWS recommends versioned names when files change often.
rewrite URLs at the edge in under a millisecondCloudFront Functions
Lightweight JavaScript on viewer events; Lambda@Edge is for heavier work.
the load balancer behind CloudFront must refuse direct requestsA secret custom header checked by the listener
Requests without it get a fixed 403; a managed prefix list can narrow the security group too.
fewer requests reaching the origin from around the worldOrigin Shield
An extra caching layer that gathers requests before they reach the origin.
A media company serves images and videos from a private S3 bucket to viewers on several continents. Pages load slowly far from the bucket's Region, the bucket must stay private, and subscribers' videos must open only for paying users without changing the player's URLs. What should a solutions architect do?
A static website in a private S3 bucket must load quickly for visitors on every continent, over HTTPS on the company's own domain, while the bucket itself stays private. What do the visitors connect to?
24 hours by default; Cache-Control max-age wins over Expires.us-east-1 for HTTPS to viewers.This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.