CloudFront Flashcards
Features:
- Content Delivery Network (CDN)
- Improves read performance, content is cached at the edge
- Improves users experience
- 216 Point of Presence globally (edge locations)
- DDoS protection (because worldwide), integration with Shield, AWS Web Application Firewall
Amazon CloudFront
What is an origin?
Location where content is stored, and from which CloudFront gets content to serve to viewers.
Four features of S3 bucket origin?
- For distributing files and caching them at the edge
- Enhanced security with CloudFront Origin Access Control (OAC)
- OAC is replacing Origin Access Identity(OAI)
- CloudFront can be used as an ingress (to upload files to S3)
Four custom origins, that are HTTP servers.
- Application Load Balancer
- EC2 instance
- S3 website (must first enable the bucket as a static S3 website)
- Any HTTP backend you want
Features:
- Global Edge network
- Files are cached for a TTL (maybe a day)
- Great for static content that must be available everywhere
CloundFront
Features:
- Cross Region Replication: Must be setup for each region you want replication to happen
- Files are updated in near real-time
- Read only
- Great for dynamic content that needs to be available at low-latency in few regions
S3 Region Replication
CloudFront is a ……,which is to cache content …..,
whereas S3 Cross-Region Replication is to….. an entire bucket into another…….
CDN, all around the world, replicate, region
Where is the cache located?
At each CloudFront Edge Location
How does CloudFront identify each object in the cache?
Cache Key
You want to maximize the Cache Hit ratio to minimize requests to the origin?
True
How can you invalidate part of the cache?
Use the CreateInvalidation API
You want to cache as much stuff as possible in your edge locations?
True
What is CloudFront Cache Key?
A unique identifier for every object in the cache
CloudFront Cache Key can have additional elements then the default ones?
True
How can you add other elements(HTTP headers, cookies, query strings) to the Cache Key?
CloudFront Cache Policies
Are all HTTP headers, cookies, and query strings that you include in the Cache Key automatically included in origin requests?
True
What happens when Cache policy HTTP header is None?
- Don’t include any headers in the Cache Key (except default)
- Headers are not forwarded (except default)
- Best caching performance
What happens when Cache policy HTTP header is Whitelisted?
- only specified headers included in the Cache Key
- Specified headers are also forwarded to Origin
Cache Policy Query Strings is None?
- Don’t include any query strings in the Cache Key
- Query strings are not forwarded
Cache Policy Query Strings is Whitelist?
- Only specified query strings included in the Cache Key
- Only specified query strings are forwarded
Cache Policy Query Strings is Include All-Except?
- Include all query strings in the Cache Key except the specified list
- All query strings are forwarded except the specified list
Cache Policy Query Strings are All?
- Include all query strings in the Cache Key
- All query strings are forwarded
- Worst caching performance
Cache Policies based on HTTP Headers?
-None
-WhiteList
Cache Policies based on Query Strings?
- None
– Whitelist
– Include All-Except
– All
What allows specifying values that you want to include in origin requests without including them in the Cache Key (no duplicated cached content)
Origin Request Policy?
Origin request policy grants ability to add CloudFront …… and …… to an origin request that were not included in the viewer request.
HTTP headers, Custom Headers
Purpose of CloudFront Cache Policy?
Controls how CloudFront caches your content at edge locations.
Purpose of CloudFront Origin Request Policy?
Controls what information CloudFront includes in requests to your origin.
Origin Request Policies can be include in…?
- HTTP Headers
- Cookies
- Query Strings
CloudFront won’t know about a back-end origin update until the TTL has expired?
True.
How can you bypass the TTL and force and entire or partial cache refresh?
Perform a CloudFront Invalidation
When will CoundFront know that the back-end origin has been updated?
After the TTL has expired causing a refresh.
With Cache Behaviors you can…… different settings for a given …… pattern
Configure,URL path
With Cache Behaviors you can …….to different kind of origins/origin groups based on the …….or ……..pattern
route, content type, path
When adding additional Cache Behaviors, the ………. is always the……. to be processed and is always /*
Default Cache Behavior, last
EC2 instances must be……., otherwise the edge locations ………… our EC2 instances because there’s no ……..connectivity in CloudFront.
public, will not be able to access, private VPC
What is Geo Restriction?
Restrict who can access your distribution based on location.
Use case:
You want to distribute paid shared content to premium users over the world.
Use CloudFront Signed URL / Cookie
Features:
- Includes URL expiration
- Includes IP ranges to access the data from
- Trusted signers (which AWS accounts can create signed URLs)
Can be included to policy attached to CloudFront Signed URL / Cookie?
What is a Signed URL for?
Grants access to individual files (one signed URL per file)
What is a Signed Cookie for?
access to multiple files (one signed cookie for many files)
Features:
- Allow access to a path, no matter
- Account wide key-pair, only the root can manage it
- Can filter by IP, path, date, expiration
- Can leverage caching features
CloudFront Signed URL
Features:
- Issue a request as the person who pre-signed the URL
- Uses the IAM key of the signing IAM principal
- Limited lifetime
S3 Pre-Signed URL
What are Origin Groups for?
To increase high-availability and do failover
How do Origin Groups work?
There is one primary and one secondary origin
If the primary origin fails, the second one is used
What is Field Level Encryption?
Protects user sensitive information through application stack
What does Field Level Encryption work?
Adds an additional layer of security along with HTTPS
encrypted at the edge close to user
How can you get real-time requests received by CloudFront sent to Kinesis Data Streams
Real Time Logs
What allows you to Monitor, analyze, and take actions based on content delivery performance
Real Time Logs
