CloudFront

Question 1

What is AWS Cloudfront?

Answer 1

• Content Delivery Network (CDN)
• Improves read performance by caching content at edge locations that are geographically closer to the end user in order to reduce latency.

Question 2

What are possible cloudfront origins?

Answer 2

• S3 buckets
• Custom origin (HTTP)

Question 3

What are the main differences between CloundFront and Cross Region Replication (CRR)?

Answer 3

CloudFront:

• Global Edge network
• Files are cached for a TTL (maybe a day)
• Great for static content that must be available everywhere

S3 CRR:

• Must be setup for each region in which you want replication to happen
• Files are updated in near real time
• Read only
• Great for dynamic content that needs to be avilable at low-latency in a few regions

Question 4

What is the difference between a CloudFront Signed URL and Signed Cookies?

Answer 4

• A signed URL provides access to individual files (one signed URL per file)
• A signed cookie provides access to multiple files (one signed cookie to multiple filesU

Question 5

Whats the difference between a CloudFront Signed URL and an S3 Pre-signed URL?

Answer 5

CloudFront Signed URL:

• Allow access to a path, no matter the origin
• Account wide key-pair, only the root can manage it
• Can filter by IP, path, date, expiration
• Can leverage caching features

S3 Pre-Signed URL:

• Issue a request as the person who pre-signed the URL
• Uses the IAM key of the signing IAM principal
• Limited lifetime

Use Cases

If you want users to take avantage of CloudFront (and you’ve set up an OAI) then you must use a CloudFront signed URL. This prevents direct access to the S3 bucket. However if you want users to have direct access to an S3 bucket, then use an S3 pre-signed url.

Question 6

How can CloudFront be restricted? What would be a use case for such restriction(s)?

Answer 6

Whitelist

Allow users to access your content only if they’re on one of the countries on a list of approved countries.

Blacklist

Prevent your users from accessing your content if they’re in one of the countries on a blacklist of banned countries.

Use Case

Copyright Laws to control access to Content

Question 7

For CloudFront GeoRestriction, how is a “country’ determined?

Answer 7

Uses a 3rd party Geo-IP database

Question 8

How can security be applied to CloudFront?

Answer 8

• HTTPS
• Black/White Lists

Question 9

What is CloudFront caching based on?

Answer 9

• Headers
• Session Cookies
• Query String Parameters

The cache is what lives at the CloudFront location.

Question 10

CloudFront is deploying in front of an HTTP origin. After updating your HTTP app, the users still see the old website. What should you do?

Answer 10

Invalidate the distribution