Amazon CloudFront Explained: Caching, OAC, HTTPS

How CloudFront speeds up and protects your site: edge caching, cache keys and TTLs, multiple origins and behaviors, Origin Access Control for private S3, HTTPS, invalidations and edge functions.

Amazon CloudFront is AWS's content delivery network. It caches your content in hundreds of edge locations around the world, so users download it from a nearby location instead of crossing the planet to your origin. It also terminates HTTPS, absorbs traffic spikes and attacks, and can run small pieces of code at the edge.

Core concepts

Distribution: your CloudFront configuration, reachable at a domain like d111111abcdef8.cloudfront.net or your own domain.
Origin: where the real content lives: an S3 bucket, an ALB, an API Gateway, any HTTP server, or a MediaStore/MediaPackage endpoint.
Cache behavior: a rule matching a path pattern (/api/*, *.jpg, default *) that chooses an origin and how to cache.
Edge location: where content is cached and served; Regional edge caches add a larger mid-tier cache.

How a request flows

A user requests https://www.example.com/images/logo.png; DNS routes them to a nearby edge.
CloudFront builds the cache key (by default, the URL path; optionally selected headers, cookies and query strings).
Cache hit: served immediately from the edge.
Cache miss: CloudFront fetches from the regional cache or origin, stores the response according to the TTL, then serves it.

A high cache hit ratio means faster pages, lower origin load and lower data transfer cost. The CloudFront console reports it per distribution.

Cache policies and TTLs

A cache policy controls what is in the cache key and how long objects stay cached (minimum, default and maximum TTL). Origins influence TTL with Cache-Control headers. Practical rules:

Include in the cache key only what changes the response. Forwarding all headers or cookies destroys your hit ratio.
Use an origin request policy to send extra headers or cookies to the origin without adding them to the cache key.
Give static assets long TTLs and versioned file names (app.3f9a1c.js), so you never need to invalidate them.
For APIs and personalized pages, use the managed CachingDisabled policy on that behavior.

Private S3 origins with Origin Access Control

Serving S3 content through CloudFront does not require a public bucket. With Origin Access Control (OAC), CloudFront signs its requests to S3, and the bucket policy allows only that distribution:

{
  "Effect": "Allow",
  "Principal": {"Service": "cloudfront.amazonaws.com"},
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::my-site-bucket/*",
  "Condition": {"StringEquals": {
    "AWS:SourceArn": "arn:aws:cloudfront::123456789012:distribution/EDFDVBD6EXAMPLE"}}
}

Keep Block Public Access on. OAC replaces the older Origin Access Identity and supports SSE-KMS encrypted objects (the key policy must allow CloudFront to decrypt).

HTTPS and custom domains

Request a certificate in AWS Certificate Manager in us-east-1; CloudFront only uses certificates from that Region.
Add your domain as an alternate domain name (CNAME) on the distribution.
Point DNS at the distribution: a Route 53 alias record, or a CNAME elsewhere.
Set the viewer protocol policy to Redirect HTTP to HTTPS.

Invalidations

An invalidation removes cached copies before their TTL expires (/index.html or /*). A number of paths each month are free; after that they cost per path. Versioned asset names are cheaper and faster than invalidating.

Security at the edge

AWS Shield Standard protects every distribution against common network attacks at no cost.
AWS WAF on the distribution blocks SQL injection, bad bots and abusive IPs, and applies rate limits.
Geo restriction, signed URLs and signed cookies for paid or private content, and field-level encryption for sensitive form fields.

Code at the edge

	CloudFront Functions	Lambda@Edge
Runtime	Lightweight JavaScript	Node.js or Python
Runs on	Viewer request and response	Viewer and origin request and response
Good for	URL rewrites, redirects, header changes, simple auth	Network calls, larger logic, body access
Cost and latency	Very low	Higher

Practice it

Build a distribution with S3 and an ALB origin in Serving Static and Dynamic Content with CloudFront, and fix the incident Website Logo Missing After Deploy. If you are starting from scratch, see How to Host a Static Website on Amazon S3.

FAQ

Does CloudFront help a site whose users are all in one country?

Usually yes: edge caching and persistent connections to the origin reduce latency, and it offloads traffic from your servers.

How long do changes to a distribution take?

Configuration changes typically propagate within minutes. Cached content stays until its TTL or an invalidation.

Amazon CloudFront Explained: Caching, Origins, OAC and HTTPS