Amazon CloudFront
Amazon CloudFront is a content delivery network. It serves data, video, applications and APIs from a global network of edge locations, so a response travels from the edge nearest the viewer rather than from the origin Region.
CloudFront chooses the edge location for each viewer from latency and health. You cannot pin a viewer to a particular edge location.
One distribution gives global reach; origin groups give availability across Regions.
Security in transit
Section titled “Security in transit”CloudFront encrypts viewer connections with HTTPS/TLS. Access to private content is controlled two ways:
- Signed URLs — a per-file access token with an expiry, and optionally an IP range restriction. Suitable when each object needs its own link.
- Signed cookies — grant access to a set of restricted files without generating a URL for each. Suitable for a subscriber area or a video library.
For origins, Origin Access Control restricts an Amazon S3 bucket or Lambda function URL so that only the distribution can reach it.
See also CloudFront SSL/TLS and SNI configuration.
Origin groups and failover
Section titled “Origin groups and failover”An origin group pairs a primary origin with a secondary. CloudFront switches to the secondary when the primary fails.
What triggers a failover
- The primary returns one of the HTTP status codes you have configured for failover. You choose any combination of 400, 403, 404, 416, 429, 500, 502, 503 and 504 — not the whole 4xx/5xx range. A 401 or a 409 does not trigger failover unless you have chosen a code you configured.
- CloudFront cannot connect to the primary, when 503 is among the configured codes.
- The primary times out, when 504 is among the configured codes.
What does not
- Failover applies only when the viewer’s request method is GET, HEAD or OPTIONS. A POST or PUT to a failing origin returns the error; it does not fail over. (For OPTIONS, the method must also be in the cache behaviour’s cached methods.)
- CloudFront routes every new request to the primary first. It does not remember that the previous request failed over, so a persistently failing primary costs a failed attempt on each cache miss.
Timing. By default CloudFront tries the primary for up to 30 seconds — three connection attempts of ten seconds. Both the timeout (1–10 seconds) and the attempt count (1–3) are configurable, as is the origin response timeout (1–120 seconds). Streaming workloads usually shorten all three.
Where origin groups are used
Section titled “Where origin groups are used”- Disaster recovery, where an outage in one Region must not take the site down.
- Cross-Region redundancy, for example two S3 buckets holding the same content in different Regions.
- Business-critical delivery — commerce and media — where the cost of downtime exceeds the cost of the second origin.
The origin group presents itself to the distribution as a single origin, so the cache behaviour points at the group and the failover logic is invisible to the viewer.