Amazon CloudFront

Global CDN that caches and delivers your content from edge locations close to your users.

Verified against AWS documentation · 2026-09-09

Key facts

01Viewers hit the nearest of CloudFront's hundreds of edge locations — on a cache hit, your origin never sees the request
02Edge locations are not Regions or AZs: far more of them, and they only cache and terminate connections, they don't run your workloads
03Origin can be anything reachable over HTTP — S3, ALB, EC2, API Gateway, or a server that isn't on AWS at all
04Caches static and dynamic content; default TTL is 24 hours, and updates go live via an invalidation or a new versioned filename
05Doubles as the security front door: HTTPS, free Shield Standard DDoS protection, WAF, geo restriction, signed URLs/cookies, and OAC to keep an S3 bucket private

Phrases and scenarios that point here.

"Global users", "reduce latency worldwide", "customers far from the Region say it's slow" → CloudFront
"Reduce load on the origin" or "lower data transfer costs out of S3/EC2" → put CloudFront in front of it
"Protect a public website from DDoS" or "block bad requests before they reach the server" → CloudFront + Shield/WAF at the edge
"Only paying subscribers" → signed URLs/cookies; "only these countries" → geo restriction

Non-HTTP traffic (TCP/UDP, gaming, VoIP) or a fixed set of static IPs → AWS Global Accelerator
Speeding up uploads into S3 → S3 Transfer Acceleration (same edge network, opposite direction)
Caching database queries or session data inside a Region → ElastiCache

01Static site or SPA hosted in S3 — the bucket stays private behind OAC, CloudFront is the only public door, and HTTPS on your own domain comes free
02One ALB in Singapore serving users in Frankfurt and Dallas without standing up a second Region — TLS terminates at the edge and the rest rides the AWS backbone
03Game patches, installers, and firmware downloads, where thousands of people pull the same 2 GB file from the edge cache instead of hammering your origin
04Subscription video, where each viewer gets a signed URL that works for them and expires before it can be shared around
05Security front door for an on-prem or non-AWS origin — WAF and Shield filter traffic at the edge before it reaches a server you can't easily scale

01Two main dials: data transfer out to viewers (per GB) and requests (per 10,000) — both priced by the edge region that served the traffic, not by where your origin sits
02Origin fetches from AWS origins (S3, EC2, ELB) into CloudFront are free, which is why fronting S3 with CloudFront usually lowers the bill rather than adding to it
03Always-free tier with no 12-month clock: 1 TB data transfer out, 10 million requests, and 2 million CloudFront Functions invocations every month
04Price Class trims cost by excluding pricier edge regions — 100 is US/Europe only, 200 adds most of Asia, All is everywhere; excluded viewers just see higher latency
05Invalidations are free for the first 1,000 paths per month, then charged per path — versioned filenames (app.v2.js) sidestep the fee entirely
06Reality check: AWS now also sells flat-rate CloudFront plans (a $0/month tier up to $1,000/month per distribution) that bundle WAF, DDoS protection, DNS and S3 credits with no overage charges. Exams still test the metered model above.