CloudFront · Content Delivery Network

Outcome

• S3 & Edge Caching
  • Explain what a distribution is and what it contains
  • Explain the difference between a cache behavior and an origin
  • Explain cache key vs origin request policy
  • Explain when to use CloudFront Functions vs Lambda@Edge
  • Explain the four hook points (viewer request/response, origin request/response)
  • Design separate cache behaviors for pass-through API routes and long-lived assets
  • Explain why CloudFront ACM certificates must be in us-east-1
  • Explain Origin Shield and when it helps
  • Explain why versioned filenames beat invalidations
  • Explain CloudFront country-level geo-restrictions and their limitations
  • Explain Price Classes and their trade-offs
• S3 & Edge Caching
  • Created a private S3 bucket and uploaded content via CLI
  • Created an OAC and wired it to an S3 origin
  • Created a CloudFront distribution with DefaultRootObject and PriceClass_100
  • Attached a bucket policy scoped to a specific distribution ARN
  • Verified OAC enforcement: direct S3 access returns 403
  • Verified cache HIT / MISS via x-cache response header
  • Added a secondary cache behavior for /assets/* with long TTL
  • Added a custom error response (403 → index.html for SPA routing)
  • Ran an explicit invalidation and waited for completion
  • Deployed a versioned filename with max-age=31536000, immutable
  • Wrote and published a CloudFront Function (viewer-request URL rewrite)
  • Wrote and published a CloudFront Function (viewer-response security headers)
  • Attached functions to a distribution and confirmed headers in curl output
  • Disabled and deleted a distribution via CLI (two-step process)
  • Cleaned up all resources: distribution, OAC, functions, cache policy, S3 bucket