Amazon CloudFront
CDN, cache near users
A content delivery network: caches files and APIs at hundreds of edge locations close to users to reduce latency.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?No
- Managed by AWS
- In examsCLF · SAA · DVA
Think of it asLike opening a store branch in every district instead of making customers travel to the central warehouse.
Where does CloudFront fit?
Calls CloudFront
- Usersends requests
Route 53points domain to
WAFfilters requests for
ACMprovides HTTPS for
CloudFront
A real example, step by step
- A course-selling site has its server in Singapore, and users in Japan and the US find pages slow to load.
- You create a CloudFront distribution: images and videos come from an S3 bucket, dynamic pages from the ALB.
- The first time a user in Tokyo opens a page, CloudFront fetches files from Singapore and keeps them at an edge location near Tokyo.
- Later visitors in Tokyo get the files straight from that edge, much faster, and the origin server does less work.
- Paid videos are protected with signed URLs; the S3 bucket stays private and only CloudFront can read it through Origin Access Control.
When to use it
✓ Use it when
Websites, video, APIs with users in many locations.
✗ Avoid it when
You need to accelerate non-HTTP protocols → Global Accelerator.
Common uses
- Speed up websites/apps for users worldwide
- Video streaming, large file downloads
- Put in front of S3 to hide the bucket (OAC) and reduce data transfer costs
- Run logic at the edge (CloudFront Functions, Lambda@Edge)
CloudFront, S3 or ELB?
| CloudFront |  S3 |  ELB | |
|---|---|---|---|
| What it does | Caches and delivers content worldwide | Stores files | Spreads traffic within one region |
| HTTPS on your own domain | Yes (ACM certificate in us-east-1) | Website endpoint is HTTP only | Yes (ACM certificate in the same region) |
| Close to users | Hundreds of edge locations worldwide | One region | One region |
| Usually paired with | S3, ALB, WAF, Lambda@Edge | CloudFront | Auto Scaling, CloudFront |
What does it cost?
- Pricing model: Per GB delivered to users (~$0.085/GB in North America/Europe, varies by region) + HTTPS requests (~$0.01/10,000). Data from AWS origins to CloudFront is free.
- Free tier: Always Free: 1 TB of data transfer + 10 million requests per month.
A low cache hit ratio (overly detailed cache key) pushes load back to the origin; choosing Price Class 'All' when users are mostly in one region.
Users may read S3 only through CloudFront → Origin Access Control + bucket policy. Paid content → signed URLs or signed cookies. Certificates for CloudFront must be in us-east-1. Accelerating non-HTTP TCP/UDP → Global Accelerator.
Try real exam questions
1A company wants to configure its Amazon CloudFront distribution to use SSL/TLS certificates. The company does not want to use the default domain name for the distribution. Instead, the company wants to use a different domain name for the distribution. Which solution will deploy the certificate without incurring any additional costs?
- ARequest an Amazon issued private certificate from AWS Certificate Manager (ACM) in the us-east-1 Region.
- BRequest an Amazon issued private certificate from AWS Certificate Manager (ACM) in the us-west-1 Region.
- CRequest an Amazon issued public certificate from AWS Certificate Manager (ACM) in the us-east-1 Region.
- DRequest an Amazon issued public certificate from AWS Certificate Manager (ACM) in the us-west-1 Region.
Show answer
Correct answer: C
Public ACM certificates are free, and CloudFront only reads certificates from the us-east-1 region. Private certificates (Private CA) are charged.
2An ecommerce company wants to launch a one-deal-a-day website on AWS. Each day will feature exactly one product on sale for a period of 24 hours. The company wants to be able to handle millions of requests each hour with millisecond latency during peak hours. Which solution will meet these requirements with the LEAST operational overhead?
- AUse Amazon S3 to host the full website in different S3 buckets. Add Amazon CloudFront distributions. Set the S3 buckets as origins for the distributions. Store the order data in Amazon S3.
- BDeploy the full website on Amazon EC2 instances that run in Auto Scaling groups across multiple Availability Zones. Add an Application Load Balancer (ALB) to distribute the website traffic. Add another ALB for the backend APIs. Store the data in Amazon RDS for MySQL.
- CMigrate the full application to run in containers. Host the containers on Amazon Elastic Kubernetes Service (Amazon EKS). Use the Kubernetes Cluster Autoscaler to increase and decrease the number of pods to process bursts in traffic. Store the data in Amazon RDS for MySQL.
- DUse an Amazon S3 bucket to host the website's static content. Deploy an Amazon CloudFront distribution. Set the S3 bucket as the origin. Use Amazon API Gateway and AWS Lambda functions for the backend APIs. Store the data in Amazon DynamoDB.
Show answer
Correct answer: D
S3 + CloudFront for static content, API Gateway + Lambda for the API, DynamoDB for data: scales to millions of requests with millisecond latency and no servers to operate.
Frequently asked questions
How is CloudFront different from an S3 static website?
An S3 static website serves files directly from one region and its website endpoint supports only HTTP. Putting CloudFront in front makes pages load faster thanks to caching near users, adds HTTPS on your own domain, and keeps the bucket private with Origin Access Control.
What is the difference between CloudFront and Global Accelerator?
CloudFront is a CDN that caches HTTP content close to users. Global Accelerator doesn't cache; it routes TCP/UDP traffic onto the AWS network through two static global IPs, which suits games, VoIP or apps that need fast cross-region failover.
How is CloudFront priced?
Mainly by the data delivered to users and the number of requests, with prices varying by region. Data transferred from AWS services such as S3 to CloudFront is free. Besides pay-as-you-go, CloudFront also offers flat-rate monthly plans.
What do AWS exams ask about CloudFront?
Origin Access Control so only CloudFront can read an S3 bucket, signed URLs and signed cookies for paid content, TTLs and invalidations, geo restriction, attaching WAF, and running code at the edge with Lambda@Edge or CloudFront Functions.