CloudFront origins, caching and geo-restriction
Origins
Section titled “Origins”A distribution can have several origins, and route to them by path.
Supported origin types:
- Amazon S3 buckets, including buckets configured for static website hosting
- Elastic Load Balancing load balancers
- EC2 instances
- AWS Elemental MediaPackage, for streaming video
- Lambda function URLs
- Any HTTP server, inside or outside AWS
Path-based routing
Section titled “Path-based routing”Cache behaviours match request paths in priority order and send each match to a different origin with its own cache settings. A typical WordPress arrangement:
- Route 53 points at the CloudFront distribution
/wp-content/*and/wp-includes/*→ an S3 bucket holding the static assets- everything else, including
/wp-login.phpand/wp-admin/*→ a load balancer in front of an EC2 fleet, with caching disabled
See cache behaviors.
Streaming video
Section titled “Streaming video”Video is delivered over standard HTTP distributions using segmented streaming formats — Apple HLS, MPEG-DASH, Microsoft Smooth Streaming and CMAF. An encoder such as AWS Elemental MediaConvert packages the content into segments and manifests; CloudFront serves the segments.
RTMP distributions, the old Adobe Flash Media Server delivery method, were retired by AWS at the end of 2020 and can no longer be created. CloudFront’s current video documentation covers only HTTP-based packaging. AWS Elemental MediaStore, once a common origin for live video, was discontinued on 13 November 2025; simple live workflows move to Amazon S3, advanced ones to AWS Elemental MediaPackage.
Cache invalidation
Section titled “Cache invalidation”Removing content from edge caches before its TTL expires. In order of preference:
Versioned paths. Publish updated content under a new path — /images/product-v2.jpg, or a build hash in the filename — and change the reference. Nothing needs invalidating, there is no propagation delay, and there is no invalidation charge. This is the recommended approach and the one deployment pipelines should default to.
TTL expiry. Deleting a file from the origin does not remove it from edge caches; objects stay until their TTL expires. TTLs come from the cache behaviour and from Cache-Control and Expires headers on the origin response. Setting a short TTL on content you expect to change is cheaper than invalidating it repeatedly.
Console or API invalidation. Invalidate specific paths, optionally with a wildcard such as /images/*. A wildcard counts as one path but can match many objects. Invalidating the whole distribution with /* is a blunt instrument and is not a routine operation. A number of paths per month are invalidated free of charge; beyond that there is a per-path charge.
Programmatic invalidation. CreateInvalidation from the SDK or CLI, integrated with a deployment pipeline, and GetInvalidation to track progress. Rate-limit the calls; the API throttles.
Invalidations propagate to every edge location, which takes minutes rather than seconds — long enough to matter during a release.
Zone apex
Section titled “Zone apex”A distribution can serve a bare domain, example.com as well as www.example.com, using a Route 53 alias record. A CNAME cannot be used at a zone apex; an alias record can.
Geographic restriction
Section titled “Geographic restriction”CloudFront can allow or block viewers by country, using the country the viewer’s IP address resolves to.
- Allow list — only the listed countries may access the content.
- Block list — the listed countries are refused.
Blocked viewers receive HTTP 403. The restriction is applied at the edge, so blocked requests never reach the origin.
Used for regulatory compliance, content licensing, and regional access control. For rules more complex than a country list — rate limits, per-path rules, request inspection — use AWS WAF on the distribution.
Practice
Section titled “Practice”Content structure. Keep static and dynamic content on separate path prefixes so their cache behaviours can differ. Structure paths so that a single wildcard invalidation is possible if it is ever needed.
Caching. Set TTLs deliberately rather than accepting defaults. Watch the cache hit ratio in CloudWatch; a low ratio usually means the cache key includes something that varies per request, such as a cookie or a query string that does not change the response.
Security. Restrict origins so only CloudFront can reach them. Require HTTPS from viewers. Apply geo-restriction or WAF where access needs limiting.