AWS Cloudfront & Global Accelerator

Question 1

What is Amazon CloudFront?

Answer 1

A Content Delivery Network (CDN) that improves the performance of content delivery by caching content at edge locations globally, reducing latency for users worldwide.

Question 2

How does CloudFront improve user experience?

Answer 2

Caching content at edge locations near users for faster access.

Reducing latency by avoiding the need to retrieve content from the origin for repeated requests.

DDoS protection by distributing traffic globally and integrating with AWS Shield and Web Application Firewall.

Question 3

What are the main types of origins CloudFront supports?

Answer 3

S3 Buckets: For distributing static files.

Custom HTTP Backends: Such as Application Load Balancers, EC2 instances, or S3 static websites.

S3 for Ingress: For uploading files to an S3 bucket through CloudFront.

Question 4

How does CloudFront caching work?

Answer 4

A client requests content from an edge location.
If the content is in the cache, it is served immediately.
If not, the edge location fetches the content from the origin (e.g., S3 bucket).
The fetched content is cached locally at the edge for future requests.

Question 5

What is required to secure an S3 bucket with CloudFront?

Answer 5

Use Origin Access Control (OAC) to ensure only CloudFront can access the S3 bucket.
Modify the S3 bucket policy to allow access only from the OAC.

Question 6

What is required for CloudFront to access an EC2 instance directly?

Answer 6

Public EC2 instance: The instance must have a public IP because CloudFront does not have private VPC connectivity.

Security Group Configuration: The security group of the EC2 instance must allow incoming requests from the public IPs of CloudFront edge locations.

Question 7

How can CloudFront access EC2 instances indirectly using an Application Load Balancer (ALB)?

Answer 7

Public ALB: The ALB must have a public IP to connect with CloudFront.

Private EC2 Instances: The backend EC2 instances can remain private within a VPC.

Security Group Rules:
ALB’s security group must allow traffic from CloudFront’s public IPs.
EC2 instances’ security group must allow traffic from the ALB’s security group.

Question 8

Why must EC2 instances or ALBs be public for CloudFront to connect?

Answer 8

CloudFront edge locations do not have private VPC connectivity, so the origin (EC2 or ALB) must be publicly accessible.

Question 9

What are the advantages of using an ALB with CloudFront instead of direct EC2 instance access?

Answer 9

Private Backend: EC2 instances can remain private within the VPC.
Load Balancing: Distribute traffic across multiple EC2 instances.
Simplified Security: Only need to allow ALB’s security group in EC2 security group.

Question 10

What is CloudFront Geo Restriction?

Answer 10

A feature that restricts access to your CloudFront distribution based on the country of the requester’s IP address.

Question 11

What are the two types of Geo Restriction lists in CloudFront?

Answer 11

Allowlist: Grants access only to the specified countries.
Blocklist: Denies access to the specified countries.

Question 12

What is a common use case for Geo Restriction?

Answer 12

Enforcing copyright laws to control access to content based on geographic regions.

Question 13

Why do CloudFront edge locations have different pricing?

Answer 13

The cost of data transfer out varies by geographic region due to differences in operational costs.

Question 14

What are CloudFront Price Classes?

Answer 14

Price Classes allow you to choose a subset of edge locations to reduce costs.

Price Class All: Uses all edge locations globally for best performance.
Price Class 200: Excludes the most expensive regions (e.g., India, South America).
Price Class 100: Limits edge locations to the least expensive regions (e.g., North America, Europe).

Question 15

What happens when CloudFront’s cache TTL expires?

Answer 15

When the TTL (Time-to-Live) expires, CloudFront fetches updated content from the backend origin (e.g., S3 bucket).

Question 16

Why might cache invalidation be necessary in CloudFront?

Answer 16

If content is updated in the backend origin, CloudFront’s edge locations won’t automatically reflect those changes until the cache TTL expires. Invalidation forces an immediate refresh of the cached content.

Question 17

What happens when you invalidate specific files like /index.html and /images/*?

Answer 17

CloudFront removes the invalidated files from the cache at edge locations.
The next time a user requests the file, CloudFront fetches it from the origin and caches the updated version.

Question 18

What is the benefit of cache invalidation in CloudFront?

Answer 18

It ensures that updated content from the backend origin is served immediately, rather than waiting for the cache TTL to expire.

Question 19

What is the main problem that AWS Global Accelerator solves?

Answer 19

It improves the performance and availability of global applications by routing traffic over the AWS global network, reducing latency and the number of hops compared to public internet routing.

Question 20

How does AWS Global Accelerator use Anycast IPs?

Answer 20

Global Accelerator assigns two Anycast IP addresses that are globally reachable. Traffic is routed to the nearest edge location based on the user’s geographic location, improving latency.

Question 21

What is the difference between Unicast IP and Anycast IP?

Answer 21

Unicast IP: One server holds one IP address; clients are routed to a specific server.
Anycast IP: Multiple servers share the same IP address; clients are routed to the nearest server.

Question 22

How does traffic flow with AWS Global Accelerator?

Answer 22

Traffic is routed from the nearest edge location over the AWS private network to the backend application, minimizing latency and avoiding the public internet.

Question 23

What services can AWS Global Accelerator work with?

Answer 23

Global Accelerator works with Elastic IPs, EC2 instances, Application Load Balancers (ALB), and Network Load Balancers (NLB), which can be public or private.

Question 24

What are the advantages of using AWS Global Accelerator for your application?

Answer 24

Consistent performance with intelligent routing to low-latency edge locations.
Fast regional failover with automated recovery.
Built-in DDoS protection through AWS Shield.
Health checks to ensure the application remains available.