Global Content Delivery and Optimization Flashcards by Rashell Smith

CloudFront

content delivery network improves the delivery of the content to viewers using caching and a global network

How well did you know this?

Not at all

Perfectly

Cloud Front Origin

the source location of your content

can be S3 origin or a custom origin (anything publicly routable)

How well did you know this?

Not at all

Perfectly

CloudFront Distribution

The configuration unit of Cloudfront

How well did you know this?

Not at all

Perfectly

CloudFront Edge Location

local cache of you data

How well did you know this?

Not at all

Perfectly

CloudFront Regional Edge Cache

Larger version of an edge location. Provides another layer of caching.

How well did you know this?

Not at all

Perfectly

Is CloudFront capable of read and write caching ?

No only does read caching uploads goes directly to origin

How well did you know this?

Not at all

Perfectly

CloudFront Behaviors

control much of the TTL, protocol and privacy settings within CloudFront

How well did you know this?

Not at all

Perfectly

How may behaviors can a distribution have?

a distribution can have many behaviors and one default behavior

How well did you know this?

Not at all

Perfectly

How do behaviors work ?

for any request that are incoming to an edge location they are pattern matched against any behaviors for that distribution using the path pattern

How well did you know this?

Not at all

Perfectly

CloudFront TTL

defined in the behavior default 24hr validity

you can also set min TTL and max TTL

How well did you know this?

Not at all

Perfectly

Per Object TTL Values

if you don’t specify an object TTL the default one attached in the behavior is used

origin can direct Cloudfront to used object specific TTL Values via headers

How well did you know this?

Not at all

Perfectly

What are some of the headers that can be used to set an object TTL values ?

origin header: cache-control max-age(seconds)

Origin Header: cache-control s-maxage(seconds)

Origin Header: Expires (Date & Time)

How well did you know this?

Not at all

Perfectly

Invalidation

performed on a distribution

applies to all edge Location.. takes time

Done by pattern matching Example:

/images/whiskers1.jpg - invalidates 1 item

/Images/*- invalidates all items in the images path

How well did you know this?

Not at all

Perfectly

Version names in with Invalidations

Versioning can help if your performing to many invalidations you can upload an item with a new version which wouldn’t require a invalidation

you would just point your application to the new object version

How well did you know this?

Not at all

Perfectly

How are you charged for invalidations ?

cost the same no matter how many objects are invalidated

should be though of as a way to correct errors

How well did you know this?

Not at all

Perfectly

AWS Certificate Manager

Allows you to create renew and deploy certificates to supported AWS services like cloudFront or application load balancers (Not EC2)

you create a certificate and ACM manages the automatic renews

HTTPS

HTTP - simple and insecure

HTTPS- SSL/TLS Layer of Encryption added to HTTP

Data is encrypted in-transit

certificates prove identity

signed by a trusted authority

Is SSL always supported in CloudFront ?

cloud front Default Domain Name(CNAME)

SSL supported by default if using CNAME .. *.cloudfront.net

Explain the process of using your a custom CNAME name with your CloudFront Distribution ?

allowed using the Alternate Domain Names feature

once the names are added and active you can point that custom name at your CloudFront Distribution using a DNS provider like Route53

CloudFront SNI mode

historically every SSL enabled site need it’s own IP

Encryption starts at the TCP connection Host header happens after that - Layer 7 // Application

SNI is a TLS extension, allowing a host to be included

to operate in SNI mode it’s free

CloudFront Without SNI mode

old browsers don’t support SNI CF charges extra for dedicated IP

600 per month per distribution

Origin Access identity

Allows you to give CloudFront a virtual identity to access the S3 Origin

only available with S3 Origin

Origin Protocol policy For origins

for s3 origin the protocol is match by default

for custom s3 origin the protocol can be HTTP, HTTPS, and Match Viewer

S3 using OAI

only available through a s3 origin

An OAI is a type of identity

it can be associated with CloudFront distributions CloudFront ‘becomes ’ that OAI

OAI can be used in s3 Bucket Policies

Deny all But one or more OAI’s

What is the benefit of associating an OAI with a distribution?

once **OAI** is associated with the distribution accesses are **From** the **OAI** *(Origin Access identity)*

How would you secure Custom Origins ?

create a custom header you can require an custom Header and enable HTTPS for both sides the viewer and origin securing your header because HTTPS is an encrypted tunnel you can also create a custom firewall to prevent any IPs that don't match AWS CloudFront

Lambda@Edge

you can run lightweight lambda at edge Locations adjust data between the viewer & origin currently supports Nde.js and python Run in the AWS public space(Not VPC)

Lambda@Edge Limits

viewer side → Memory of 128 MB and function time out of 5 Seconds Origin side → Memory same as normal Lambda function and function time out of 5 Seconds

Lambda@Edge Use cases

A/B testing - viewer request migration Between s3 origin - origin Request Different Object Based on Device - origin Request content By country- origin request

Global Accelerator

Moves the AWS network Closer to customers: Traffic initially uses public internet & enters a Global Accelerator Edge Location Connections enter at edge … using any cast IPS: Anycast IP's allow a single IP to be in multiple Locations. Routing moves traffic to the closest location Transit over AWS backbone to it's locations: From the edge, data transits globally across the AWS global backbone network. Less hops, directly under AWS control, significantly better performance

What's the difference between CloudFront and Global Accelerator

Global Accelerator can be used for non HTTP/s (TCP/UDP)

When would you use CloudFront ?

if you need caching or content delivery or manipulation of that delivery

When would you use Global Accelerator?

If you want TCP or UDP network optimization

Explain the process of using your a custom CNAME name with your CloudFront Distribution if using HTTPS ?

if using HTTPS you you need a certificate applied to the distribution matching that name the way to do that is to generate or import an certificate in ACM in use-east-1 because CloudFront is a regional service