Caching

Question 1

CloudFront Security

Answer 1

DDoS protections, AWS Shield, WAF

Question 2

Cloudfront Ingress

Answer 2

Can upload to S3 even though S3 transfer acceleration will be more efficient

Question 3

CloudFront HA

Answer 3

Has support for primary and secondary origins for failover

Question 4

CloudFront S3 origin

Answer 4

Traffic goes through private aws network, faster

Question 5

CloudFront EC2

Answer 5

• EC2 must be public, its SG needs to allow traffic from all edge location public ips.
• Traffic goes through public internet

Question 6

CloudFront + ALB + EC2

Answer 6

• EC2 can be private, its SG needs to allow traffic ALB SG
• ALB is public, its SG needs to allow traffic from all edge location public ips.
• Traffic goes through public internet

Question 7

CloudFront vs Cross Region Replication

Answer 7

CloudFront:

• Global Edge replication
• Files are cached for TTL
• Great for static content that must be available everywhere

S3 CRR:

• Must setup replication for each region
• Near real time replication
• Replication buckets are read only, source is only one
• Great for dynamic content that needs to be available at low latency in a few regions

Question 8

CloudFront Geo Restriction

Answer 8

• Whitelist and Blacklist of countries that can(not) access content
• Country determined using 3rd party ip database

Question 9

ClouFront signed URLs/Signed cookies

Answer 9

We attach a policy:

• URL expiration date
• IP ranges to access data from
• Trusted signers (which AWS accounts can create signed URLs)

Signed URL - access to one file
Signed Cooke - access to multiple files

Question 10

CloudFront URL vs S3 Pre-signed URL

Answer 10

CloudFront:

• Allow access to a path no matter the origin (backend, s3)
• Account wide key-pair, only root can create signs URLs
• Can filter by ip, path, expiration, date
• Can leverage caching features

Question 11

CloudFront Caching

Answer 11

Based on:

• Headers
• Session Cookies
• Query Parameters

Live on each edge location
TTL set by Header sent in response from origin:
- Control-Cache
- Expires

Question 12

Lambda@Edge

Answer 12

• Lambda is deployed globally alongside CloudFront
• Can implement request filtering (using lambda) before reaching application
• Pay only for what you use
• Does not have any cache

Question 13

CloudFront HTTPS configuration and Host

Answer 13

If Host header is not forwarded to origin, CloudFront will Host header with the value of the origin

Question 14

ElasticCache

Answer 14

• Managed Redis or Memchached
• Involves heavy application code changes
• Must have invalidation strategy