Amazon CloudFrontAuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

• Edge locations and regional cachesA request goes to a nearby edge location. On a miss it travels through a regional edge cache before it reaches your origin, so popular objects are fetched from the origin far less often than they are served.
• Many kinds of originAn S3 bucket, an Application or Network Load Balancer, API Gateway, a Lambda function URL, a media service or any web server on the internet. VPC origins let CloudFront reach load balancers and instances in a private subnet.
• Cache policies you can reuseA cache policy says what makes two requests the same (headers, cookies, query strings) and how long to keep the object. AWS ships managed policies such as CachingOptimized and CachingDisabled, and you can write your own.
• Private originsOrigin access control makes CloudFront sign its requests to S3 and to Lambda function URLs, so the origin can refuse everyone else. It replaces the older origin access identity.
• Code at the edgeCloudFront Functions run short JavaScript in under a millisecond for URL rewrites, redirects and header changes. Lambda@Edge runs Node.js or Python for heavier work and can call other services.
• Private contentSigned URLs and signed cookies, built on key groups, let only authorised users fetch a file for a limited time. Geographic restrictions and field-level encryption are available too.
• Protection at the edgeShield Standard absorbs common network attacks at no charge. AWS WAF attaches to a distribution for rate limits, bot control and managed rules, and ACM issues free certificates for your domain.
• Two ways to payPay-as-you-go bills data transfer and requests, with an always-free allowance. The flat-rate plans bundle delivery with WAF, DDoS protection and DNS for a fixed monthly price, which AWS describes as having no overage charges.

Distribution

The CloudFront configuration that you point a domain at. It holds the origins, the behaviors, the certificate, the logging and the security settings, and it has its own *.cloudfront.net name.

Edge location and regional edge cache

An edge location is where viewers connect. A regional edge cache is a larger cache layer behind several edge locations that holds objects longer.

Origin

The server that has the original content. CloudFront asks it only when an object isn’t cached or has expired.

Cache behavior

A rule that matches a path pattern, such as /assets/*, and says which origin, cache policy, protocols and functions apply. The default behavior handles everything else.

Cache policy

Defines the cache key (which headers, cookies and query strings count) and the minimum, default and maximum time to live.

Origin request policy

Defines what CloudFront forwards to the origin on a miss, separately from the cache key, so you can send a header without caching per value of it.

Response headers policy

Adds headers to every response, such as security headers and CORS rules, without code.

Invalidation

A request to remove objects from the edge caches before their TTL ends. The first 1,000 paths a month in an account are free, and extra paths cost a small fixed fee.

Origin access control (OAC)

Lets CloudFront authenticate to S3 with signed requests, so the bucket can be fully private.

Viewer protocol policy

Whether viewers may use HTTP, are redirected to HTTPS, or may only use HTTPS.

Signed URL and key group

A URL with an expiry and a signature made by a private key that you hold. CloudFront checks it with the public key in a key group.

CloudFront Functions and Lambda@Edge

Two ways to run code on requests and responses. Functions are fast and limited, and Lambda@Edge is slower to start and much more capable.

Origin Shield

An optional extra cache layer in one chosen Region that all misses pass through, which cuts the load on the origin further.

Put a private S3 site behind CloudFront with the AWS CLI

1. Decide what can be cachedStatic files, images, scripts and public API answers can. Anything personal, or anything that must be exact to the second, needs a short TTL or no caching.
2. Keep the origin privateCreate the bucket with all public access blocked, and use origin access control so that only CloudFront can read it.
3. Create the distribution with safe defaultsRedirect HTTP to HTTPS, turn on compression, use the CachingOptimized managed policy, allow HTTP/3 and choose a price class that matches where your viewers are.
4. Allow only this distributionAdd a bucket policy that lets the CloudFront service read objects when AWS:SourceArn is this distribution’s ARN.
5. Add behaviors per pathGive /assets/ a long TTL and /api/ a policy that forwards what the API needs, or no caching at all.
6. Attach your domain and certificateRequest the certificate in ACM in us-east-1, add the domain as an alternate domain name, and point DNS at the distribution.
7. Version your filesPut a content hash in file names such as app.3f9c1a.js, so a release needs no invalidation. Invalidate only the entry pages.
8. Turn on protection and logsAttach a web ACL for rate limits and bad bots where needed, and send logs somewhere you can read.
9. Watch the numbersAlarm on 5xxErrorRate and TotalErrorRate, and look at the cache hit ratio after each change to a cache policy.

• Give assets long TTLs and versioned names, so repeat visits are served from the browser cache or the edge.
• Keep the cache key small: forward only the headers, cookies and query strings that change the response.
• Turn on compression (Brotli and gzip), so text files travel at a fraction of their size.
• Use HTTP/3 and keep the price class matched to where your viewers are.
• Enable Origin Shield for origins that are slow or costly to hit, so misses from all edge locations collapse into one request.
• Use CloudFront Functions for short rewrites and redirects, and keep Lambda@Edge for work that needs it.
• Set origin keep-alive and timeouts sensibly, and put the origin in a Region close to the largest audience.
• Cache short-lived API answers for a few seconds, which absorbs bursts without showing old data for long.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Amazon CloudFront.

• Use the always-free allowance (1 TB and 10 million requests a month) for small sites, and compare it with the free flat-rate plan.
• Compare pay-as-you-go with flat-rate plans for each site. Predictable, busy sites can be cheaper on a plan.
• Pick a price class that excludes the most expensive regions if your viewers aren’t there.
• Compress text responses and size images properly, since you pay by the byte.
• Raise cache hit ratio, so fewer requests reach the origin and the extra regional fetches are avoided.
• Use versioned file names instead of invalidation. The first 1,000 invalidation paths a month are free, and more are billed per path.
• Prefer CloudFront Functions to Lambda@Edge where they are enough, since they cost much less per request.
• Remember that data transfer from AWS origins to CloudFront is free, so S3 and load balancer origins don’t add transfer charges for the fetch.
• Sample or limit real-time logs, and keep standard logs only as long as you need them.
• Add WAF rate limits and a budget alert to catch abusive traffic early.

• Use origin access control for S3 and Lambda function URLs, and a VPC origin for private load balancers and instances.
• Redirect to HTTPS only, pick the newest security policy for the viewer certificate and add a response headers policy for HSTS and other headers.
• Attach AWS WAF with rate rules, managed rule groups and bot control where the application needs them.
• Protect private downloads with signed URLs or cookies, short expiry times and key groups that you rotate.
• Allow only CloudFront IP ranges (the managed prefix list) or VPC origins on the origin side.
• Enable standard logging and, where useful, real-time logs, and send them to a bucket with restricted access.
• Restrict who can change distributions, and alert on UpdateDistribution and DeleteDistribution.
• Use field-level encryption or keep sensitive fields out of the request path for forms that carry card data.
• Use geographic restrictions where law or licence requires them.
• Review Security Hub and AWS Config findings for distributions without WAF, logging or HTTPS.

AWS CloudTrail records who changed distributions and policies, AWS Config keeps the configuration history, Security Hub reports on settings, and AWS Artifact holds compliance reports. AWS runs the edge network and the service. Origins, cache rules, certificates, access to private content and what you put in logs are yours.

• Raise the cache hit ratio, so the origin serves fewer requests.
• Serve Brotli or gzip for text and resize images, which cuts the bytes sent.
• Use Brotli, modern image formats and HTTP/3 to cut transfer.
• Remove unused distributions and behaviors, and stop logging that nobody reads.
• Origins can sit in a Region with a cleaner power grid, provided data rules and latency allow it.
• The AWS carbon tool reports per account and does not list CloudFront on its own, so quote no CloudFront figure.

Purchase options

What you actually pay for

• Data transfer out to viewers and requests, or a flat monthly plan
• CloudFront Functions and Lambda@Edge invocations
• Invalidation paths beyond 1,000 a month
• Origin Shield requests, real-time logs and any dedicated IP addresses
• AWS WAF, if you don’t use a plan that bundles it

A static site: a private S3 bucket, an origin access control, a distribution that redirects to HTTPS, compresses and uses the managed CachingOptimized policy, a bucket policy tied to that one distribution, an invalidation and an error-rate check. The CLI tab builds it; Terraform describes the same resources. The Python tab invalidates paths and waits for the result, and creates an expiring signed URL; the C# tab audits every distribution for HTTP access, a missing web ACL, no logging and the old origin access identity. Replace the bucket name and Region with your own.

# Placeholders: replace the bucket name with your own. CloudFront is global, and its API and metrics live in us-east-1.
REGION=us-east-1
BUCKET=cb-site-demo-$RANDOM
ACCOUNT=$(aws sts get-caller-identity --query Account --output text)

# 1. A private bucket for the site, and one page to serve. Nothing is public: only CloudFront will be allowed in.
aws s3api create-bucket --bucket $BUCKET --region $REGION
aws s3api put-public-access-block --bucket $BUCKET \
  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
echo '<h1>Hello from the edge</h1>' > index.html
aws s3 cp index.html s3://$BUCKET/index.html --content-type text/html --cache-control "public, max-age=300"

# 2. Origin access control: CloudFront signs its requests to S3, so the bucket can stay private.
OAC_ID=$(aws cloudfront create-origin-access-control --origin-access-control-config \
  Name=$BUCKET-oac,OriginAccessControlOriginType=s3,SigningBehavior=always,SigningProtocol=sigv4 \
  --query OriginAccessControl.Id --output text)

# 3. The distribution. HTTP is redirected to HTTPS, responses are compressed, and the managed CachingOptimized policy
#    (658327ea-...) sets the cache key and TTLs. 403 and 404 from S3 return index.html, which a single-page app needs.
cat > distribution.json <<JSON
{
  "CallerReference": "$BUCKET", "Comment": "static site", "Enabled": true, "DefaultRootObject": "index.html",
  "PriceClass": "PriceClass_100", "HttpVersion": "http2and3", "IsIPV6Enabled": true,
  "Origins": {"Quantity": 1, "Items": [{"Id": "s3-site", "DomainName": "$BUCKET.s3.$REGION.amazonaws.com",
    "OriginAccessControlId": "$OAC_ID", "S3OriginConfig": {"OriginAccessIdentity": ""}}]},
  "DefaultCacheBehavior": {"TargetOriginId": "s3-site", "ViewerProtocolPolicy": "redirect-to-https", "Compress": true,
    "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
    "AllowedMethods": {"Quantity": 2, "Items": ["GET", "HEAD"], "CachedMethods": {"Quantity": 2, "Items": ["GET", "HEAD"]}}},
  "CustomErrorResponses": {"Quantity": 2, "Items": [
    {"ErrorCode": 403, "ResponsePagePath": "/index.html", "ResponseCode": "200", "ErrorCachingMinTTL": 10},
    {"ErrorCode": 404, "ResponsePagePath": "/index.html", "ResponseCode": "200", "ErrorCachingMinTTL": 10}]}
}
JSON
DIST_ID=$(aws cloudfront create-distribution --distribution-config file://distribution.json --query Distribution.Id --output text)

# 4. Let this one distribution, and nothing else, read the bucket.
cat > bucket-policy.json <<JSON
{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Principal": {"Service": "cloudfront.amazonaws.com"},
  "Action": "s3:GetObject", "Resource": "arn:aws:s3:::$BUCKET/*",
  "Condition": {"StringEquals": {"AWS:SourceArn": "arn:aws:cloudfront::$ACCOUNT:distribution/$DIST_ID"}}}]}
JSON
aws s3api put-bucket-policy --bucket $BUCKET --policy file://bucket-policy.json

# 5. Wait for the deployment, then request the page twice. The first answer says Miss from cloudfront, the second Hit.
aws cloudfront wait distribution-deployed --id $DIST_ID
DOMAIN=$(aws cloudfront get-distribution --id $DIST_ID --query Distribution.DomainName --output text)
curl -sI https://$DOMAIN/ | grep -i -E "^(HTTP|x-cache|age)"
curl -sI https://$DOMAIN/ | grep -i -E "^(HTTP|x-cache|age)"

# 6. After a release, clear the changed pages from the edge caches. The first 1,000 paths a month are free.
aws cloudfront create-invalidation --distribution-id $DIST_ID --paths "/index.html" "/assets/*"

# 7. Edge error rate over the last hour. CloudFront metrics are published in us-east-1 with the Region dimension Global.
aws cloudwatch get-metric-statistics --region us-east-1 --namespace AWS/CloudFront --metric-name 5xxErrorRate \
  --dimensions Name=DistributionId,Value=$DIST_ID Name=Region,Value=Global --statistics Average --period 300 \
  --start-time $(date -u -d '-1 hour' +%FT%TZ) --end-time $(date -u +%FT%TZ)

# Placeholders: pass in your own bucket name. CloudFront certificates and metrics live in us-east-1.
variable "bucket_name" {
  type = string
}

provider "aws" {
  region = "us-east-1"
}

data "aws_cloudfront_cache_policy" "optimized" {
  name = "Managed-CachingOptimized"
}

data "aws_cloudfront_response_headers_policy" "security" {
  name = "Managed-SecurityHeadersPolicy"
}

resource "aws_s3_bucket" "site" {
  bucket = var.bucket_name
}

resource "aws_s3_bucket_public_access_block" "site" {
  bucket                  = aws_s3_bucket.site.id
  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy     = true
  restrict_public_buckets = true
}

resource "aws_cloudfront_origin_access_control" "site" {
  name                              = "${var.bucket_name}-oac"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

resource "aws_cloudfront_distribution" "site" {
  enabled             = true
  is_ipv6_enabled     = true
  http_version        = "http2and3"
  price_class         = "PriceClass_100"
  default_root_object = "index.html"

  origin {
    origin_id                = "s3-site"
    domain_name              = aws_s3_bucket.site.bucket_regional_domain_name
    origin_access_control_id = aws_cloudfront_origin_access_control.site.id
  }

  default_cache_behavior {
    target_origin_id           = "s3-site"
    viewer_protocol_policy     = "redirect-to-https"
    allowed_methods            = ["GET", "HEAD"]
    cached_methods             = ["GET", "HEAD"]
    compress                   = true
    cache_policy_id            = data.aws_cloudfront_cache_policy.optimized.id
    response_headers_policy_id = data.aws_cloudfront_response_headers_policy.security.id
  }

  # S3 answers 403 for a missing key when the caller can't list the bucket, which a single-page app sees on every deep link.
  custom_error_response {
    error_code            = 403
    response_code         = 200
    response_page_path    = "/index.html"
    error_caching_min_ttl = 10
  }

  custom_error_response {
    error_code            = 404
    response_code         = 200
    response_page_path    = "/index.html"
    error_caching_min_ttl = 10
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true # use an ACM certificate (in us-east-1) for your own domain
  }
}

data "aws_iam_policy_document" "site" {
  statement {
    actions   = ["s3:GetObject"]
    resources = ["${aws_s3_bucket.site.arn}/*"]

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      values   = [aws_cloudfront_distribution.site.arn]
    }
  }
}

resource "aws_s3_bucket_policy" "site" {
  bucket = aws_s3_bucket.site.id
  policy = data.aws_iam_policy_document.site.json
}

output "domain_name" {
  value = aws_cloudfront_distribution.site.domain_name
}

# pip install boto3 cryptography
# Invalidates paths and waits until it is done, and makes a signed URL that stops working after a few minutes.
import datetime as dt
import time

import boto3
from botocore.signers import CloudFrontSigner
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding

cloudfront = boto3.client("cloudfront")  # the API is global


def invalidate(distribution_id, paths, wait=True):
    """Removes the paths from the edge caches. The caller reference only has to be unique, and the first 1,000 paths a month are free."""
    reply = cloudfront.create_invalidation(
        DistributionId=distribution_id,
        InvalidationBatch={"Paths": {"Quantity": len(paths), "Items": paths}, "CallerReference": "release-%d" % time.time()},
    )
    invalidation_id = reply["Invalidation"]["Id"]
    if wait:
        cloudfront.get_waiter("invalidation_completed").wait(DistributionId=distribution_id, Id=invalidation_id)
    return invalidation_id


def signed_url(url, key_pair_id, private_key_pem, minutes=10):
    """A URL that CloudFront accepts until it expires. key_pair_id is the ID of the public key in the distribution's key group."""
    private_key = serialization.load_pem_private_key(private_key_pem, password=None)

    def rsa_signer(message):
        return private_key.sign(message, padding.PKCS1v15(), hashes.SHA1())  # CloudFront's canned policy uses RSA with SHA-1

    expires = dt.datetime.now(dt.timezone.utc) + dt.timedelta(minutes=minutes)
    return CloudFrontSigner(key_pair_id, rsa_signer).generate_presigned_url(url, date_less_than=expires)


if __name__ == "__main__":
    distribution = cloudfront.list_distributions()["DistributionList"].get("Items", [])[0]
    print("invalidation:", invalidate(distribution["Id"], ["/index.html", "/assets/*"], wait=False))

// dotnet add package AWSSDK.CloudFront
// Audits every distribution: HTTP allowed, no web ACL, logging off, and S3 origins that still use the old origin access identity.
using Amazon.CloudFront;
using Amazon.CloudFront.Model;

using var cloudfront = new AmazonCloudFrontClient();
int problems = 0;
string? marker = null;

do
{
    var page = await cloudfront.ListDistributionsAsync(new ListDistributionsRequest { Marker = marker });
    foreach (DistributionSummary summary in page.DistributionList.Items ?? new List<DistributionSummary>())
    {
        DistributionConfig config = (await cloudfront.GetDistributionConfigAsync(new GetDistributionConfigRequest { Id = summary.Id })).DistributionConfig;
        string name = summary.Aliases.Items?.FirstOrDefault() ?? summary.DomainName;

        if (config.DefaultCacheBehavior.ViewerProtocolPolicy == ViewerProtocolPolicy.AllowAll)
        {
            Console.WriteLine($"{name}: plain HTTP is allowed (viewer protocol policy allow-all)");
            problems++;
        }
        if (string.IsNullOrEmpty(config.WebACLId))
        {
            Console.WriteLine($"{name}: no web ACL is attached");
            problems++;
        }
        if (config.Logging?.Enabled != true)
        {
            Console.WriteLine($"{name}: standard logging is off");
            problems++;
        }
        foreach (Origin origin in config.Origins.Items.Where(o => !string.IsNullOrEmpty(o.S3OriginConfig?.OriginAccessIdentity)))
        {
            Console.WriteLine($"{name}: origin {origin.Id} uses the old origin access identity, so move it to origin access control");
            problems++;
        }
    }
    marker = page.DistributionList.IsTruncated == true ? page.DistributionList.NextMarker : null;
} while (marker != null);

Console.WriteLine(problems == 0 ? "No problems found." : $"{problems} problem(s) found.");
return problems == 0 ? 0 : 1;

Videos picked for this service. Each one is labelled with its source, opens on YouTube if you prefer, and loads only when you press play.

Typical origins are Amazon S3 and Amazon API Gateway, and load balancers from Elastic Load Balancing. Metrics and alarms live in Amazon CloudWatch, and code at the edge can be written with AWS Lambda as Lambda@Edge.