Learn
AWS
Networking & content delivery
CloudFront

AWSGCP laterAzure later

CloudFrontAmazon CloudFront

Networking & content deliveryCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

A content delivery network: copies of your files are cached at edge locations near viewers, and requests that miss go back to your origin over the AWS network.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalHIGHDeveloper – AssociateMEDSysOps Administrator – AssociateMEDSecurity – SpecialtyMED

Where CloudFront takes you5 steps, all open

I know the problem it solves
I can picture it
I know when to choose it
I can use it in a design
I can answer an exam question

What & why

Your files, close to every viewer

Amazon CloudFront speeds up delivery of static and dynamic web content through a worldwide network of edge locations. Each request goes to the edge location with the lowest latency: if the file is cached there, it comes back at once; if not, CloudFront fetches it from your origin, such as an S3 bucket or a web server, and caches it for the next viewer.

More than a cache. A distribution also serves HTTPS with your own certificate, keeps private content private, blocks countries, fails over between origins, and runs small functions at the edge. Transfer from AWS origins to CloudFront is free.

Reach for it when

viewers around the world load the same images, scripts and videos
an S3 bucket should serve a site without being made public
paid content must open only with a signed URL or signed cookies
headers or URLs must be changed at the edge, before the origin sees the request

It is the wrong tool when

clients need fixed IP addresses routed to the nearest healthy Region: that is Global Accelerator
every viewer must see a change the instant it is made: cached copies last until they expire or are invalidated

Mental model

Corner shops and a central warehouse

A chain of corner shops stocked from one warehouse. You buy from the shop on your street; if it has the item, you walk out with it. If not, the shop orders it from a larger regional depot, or from the warehouse, and keeps some on the shelf for the next customer. Anything past its sell-by date is checked with the warehouse before it is sold again.

The central warehousewhere the real files liveOrigin

The shop on your streeta cache near the viewerEdge location

The regional depota larger cache between the shops and the warehouseRegional edge cache

The sell-by datehow long a copy is trustedTTL

The members-only countercontent served only with a passSigned URL or cookie

A back door only the delivery van can opena bucket only the distribution can readOrigin access control

How it works

Origin, distribution, behaviors, edge

Name the originAn S3 bucket, a load balancer, a Lambda function URL, API Gateway or any web server holds the real files.
Create a distributionIt gets a cloudfront.net domain name, and can take your own, with a certificate from ACM in us-east-1.
Set cache behaviorsPer path pattern: which origin, how long to cache, and the viewer protocol policy, such as redirecting HTTP to HTTPS.
Serve from the edgeA hit is returned at once; a miss is fetched from the origin and cached for the next request.

Default TTL: 24 hourswithout a cache policy; minimum 0
ACM certificate: us-east-1for HTTPS to viewers
Origin failover: GET, HEAD, OPTIONSper request, to a secondary origin
Before failing over: 30 seconds3 connection attempts of 10 s, by default
CloudFront Functions: Submillisecondviewer events, 2 MB of memory
Lambda@Edge: Up to 30 sviewer and origin events, with network access

Viewer protocol
Does the request meet the cache behavior's viewer protocol policy? HTTPS only answers plain HTTP with 403.
Geo restriction
Is the viewer's country allowed? A block list or allow list covers the whole distribution.
Private content
If this path is private, does the request carry a valid signed URL or signed cookie?
Cache
Is a fresh copy at this edge location? If not, CloudFront asks the regional edge cache, then the origin.

Pick a case to follow the request through each check.

Architecture

One domain, two origins

Viewers reach one distribution under the company's domain; its behaviors send the site to a private bucket and /api/* to a load balancer.

Two origins, one domain. Cache behaviors send requests matching /api/* to the load balancer and everything else to the bucket, all under one domain name.

The bucket stays private. Origin access control signs CloudFront's requests, and the bucket policy allows only this distribution, so nobody can use S3 URLs to get around it.

The load balancer answers only CloudFront. CloudFront adds a secret custom header, the listener forwards only requests that carry it, and everything else gets a 403.

Protection at the edge. The web ACL, with Shield Standard underneath, stops attacks before they reach either origin.

Security

Private origins, private content

HTTPS both ways. Redirect HTTP to HTTPS, or accept HTTPS only, for viewers, and use HTTPS to the origin as well.

Origin access control, not OAI. AWS recommends OAC: it works with buckets in every Region, with SSE-KMS encrypted objects, and with PUT and DELETE. An S3 website endpoint cannot use it, because it counts as a custom origin.

Signed URLs or signed cookies for private content: a URL for a single file or a client without cookies, cookies for many files without changing their URLs. Where both are present, the signed URL decides.

Geo restriction allows or blocks whole countries for the whole distribution. For part of the content, or finer than a country, use a geolocation service with signed URLs.

VPC origins. An Application Load Balancer, Network Load Balancer or EC2 instance in a private subnet can be served through CloudFront without ever facing the internet.

Cost

How you are charged, not what it costs today

Data transfer out from edge locations to viewers, and HTTP and HTTPS requests, with rates that vary by geography.

Free from AWS origins. Transfer from S3, Elastic Load Balancing or API Gateway to CloudFront is not charged.

Extras: invalidations, CloudFront Functions, Lambda@Edge, real-time logs, Origin Shield and dedicated IP certificates.

Flat-rate plans bundle delivery with WAF, DDoS protection, DNS and edge compute for a monthly fee, as an alternative to paying as you go.

Prices change, so none are printed here. Check the CloudFront pricing page on aws.amazon.com.

Comparison

Edge options, edge code, private content

Service	What it does	Choose it when
CloudFront	Caches content at edge locations near viewers	Websites, APIs and video for viewers everywhere
Global Accelerator	Two static anycast IP addresses, routed over the AWS network to healthy Regional endpoints	Fixed IP addresses and instant rerouting around unhealthy endpoints
S3 website endpoint	Serves a public bucket directly, over HTTP	A simple public site with no CDN in front

Edge code	Runs on	Limits	Choose it when
CloudFront Functions	Viewer requests and responses	Submillisecond, 2 MB memory, 10 KB of code, no network	Header changes, redirects, cache keys, token checks
Lambda@Edge	Viewer and origin requests and responses	Up to 30 s, up to 10 GB memory on origin events, network and body access	Calls to other services, request bodies, heavier logic

Private content	Covers	Choose it when
Signed URL	One file	A download link, or clients that do not support cookies
Signed cookies	Many files	A members' area or a video's many segments, with URLs unchanged

SAA traps

The phrase in the question, and what it means

reduce latency for static content served to users worldwideCloudFront

Edge locations serve cached copies near each viewer.

users must not bypass CloudFront to read the S3 bucketOrigin access control

The bucket policy allows only the distribution, so S3 URLs stop working for viewers.

a certificate requested in eu-west-1 for the distribution's custom domainRequest it in us-east-1

CloudFront uses ACM certificates only from US East (N. Virginia).

restrict many premium files without changing their URLsSigned cookies

Signed URLs suit single files; cookies cover many at once.

block viewers in specific countriesGeo restriction

An allow or block list of countries for the whole distribution, answered with 403.

switch to a backup origin when the primary returns 5xx errorsAn origin group

CloudFront retries that request on the secondary, for GET, HEAD and OPTIONS.

users still see old files after a deploymentVersioned file names, or an invalidation

AWS recommends versioned names when files change often.

rewrite URLs at the edge in under a millisecondCloudFront Functions

Lightweight JavaScript on viewer events; Lambda@Edge is for heavier work.

the load balancer behind CloudFront must refuse direct requestsA secret custom header checked by the listener

Requests without it get a fixed 403; a managed prefix list can narrow the security group too.

fewer requests reaching the origin from around the worldOrigin Shield

An extra caching layer that gathers requests before they reach the origin.

Scenario

Exam style, marked when you answer

A media company serves images and videos from a private S3 bucket to viewers on several continents. Pages load slowly far from the bucket's Region, the bucket must stay private, and subscribers' videos must open only for paying users without changing the player's URLs. What should a solutions architect do?

Practice

Fill the gap, the way the challenges work

A static website in a private S3 bucket must load quickly for visitors on every continent, over HTTPS on the company's own domain, while the bucket itself stays private. What do the visitors connect to?

Web client· Visitors on every continentPick a service belowS3· Site files, private

Quick revision

The night before the exam

What: A CDN: cached copies at edge locations near viewers.
A miss: Edge location, then regional edge cache, then the origin.
TTL: 24 hours by default; Cache-Control max-age wins over Expires.
OAC: Keeps an S3 origin private; not for website endpoints.
Certificates: ACM in us-east-1 for HTTPS to viewers.
Private content: A signed URL for one file, signed cookies for many.
Failover: Origin group: the secondary on chosen codes, for GET, HEAD, OPTIONS.
Edge code: Functions for tiny viewer tweaks; Lambda@Edge for the rest.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.