CloudFront

Question 1

What is CloudFront?

Answer 1

o CloudFront is a content delivery network (CDN) for AWS. A CDN is a global cache that stores copies of data on edge caches, which are position as close to customers as possible. It has 3 main benefits: lower latency, higher transfer speed, reduced load on the content server

Question 2

What are CloudFront components?

Answer 2

o CF has the following components:
 Origin: The service or service that hosts your content (S3 bucket, web server, Amazon MediaStore);
 Distribution: The “configuration” entity within CF. It is where you configure all aspects of a specific “implementation” of CF from;
 Edge Location: The local infrastructure that hosts caches of your data, positioned in over 150 locations in 30 countries;
 Regional Edge Caches: Larger versions of edge locations. Less of them, but with more capacity and ability to serve larger areas

Question 3

How does the Caching process in CloudFront work?

Answer 3

o Caching Process:
 Create a distribution, and point at one or more origins. A distribution has a DNS address, that is used to access it
 The DNS address directs clients at the closest available edge location
 If the edge location has a cached copy of your data, it’s delivered locally from that edge location
 Otherwise, the edge location tries to download it from the regional cache or from an origin
 As the edge location receives the data, it immediately begins forwarding it and caches it for the next visitor

Question 4

What is a CloudFront OAI (Origin Access Identity)?

Answer 4

o By default, CloudFront is fully publicly accessible – anyone with the DNS endpoint address can access content cached by the distribution
o A distribution can be configured to be private where each access requires a signed URL or cookie. This is done by setting the trusted signers on the distribution
o Private distribution can be bypassed by going straight to the origin (e.g. an S3 bucket)
o An Origin Access Identity is a virtual identity that can be associated with a distribution. An S3 bucket can then be restricted to only allow this OAI to access it
o OAI are used when wanting users to only access the private CF distribution and not the origin bucket and for better S3 distribution and user experience