Cloudfront

Question 1

In Cloudfront, where do you generate a signed URL

Answer 1

You can only generate a signed URL from the SDK. This means you need to code up verification for users and then generate signed URL’s.

Question 2

A Cloudfront URL policy has 3 key components. What are they?

Answer 2

URL Expiration Time
IP ranges allowing access
Trusted Signers - which AWS accounts can create a signed URL

Question 3

You have a S3 bucket tied to a cloudfront distribution. Can you use an S3 signed URL for restricting access to content?

Answer 3

No. You must use a cloudfront signed URL

Question 4

What is the role of the Certificate Manager in Cloudfront?

Answer 4

It provides encryption in transit between Cloudfront and end users

Question 5

You are hosting highly dynamic data out of US-EAST-1 and you need to replicate this to EU-WEST-1 with latency being an issue. Would you use Cloudfront or S3 Cross Region Replication for this. Why, Why not?

Answer 5

The key to this is the 24hr TTL in Cloudfront. While Cloudfront does allow for replication and very low latency ACCESS, items in cache have a TTL of 24 hours meaning that what we replicate could be quite out of date. In this case, S3 XRR is a much better option.

Question 6

What are the 3 AWS services cloudfront can work with?

Answer 6

S3, EC2, ELB’s