What is Amazon CloudFront and how does a CDN work?
Learn how Amazon CloudFront caches content at edge locations to cut latency, offload origins, and secure delivery with HTTPS, WAF, and invalidations.
Expected Interview Answer
Amazon CloudFront is AWS's content delivery network (CDN) that caches and serves content from edge locations close to users, reducing latency and offloading traffic from the origin.
A CDN keeps copies of static and dynamic content at globally distributed edge locations. When a user requests content, CloudFront routes them to the nearest edge; on a cache hit it serves the cached copy instantly, and on a miss it fetches from the origin (S3, an ALB, or a custom server), caches it per the cache policy, and returns it. CloudFront also integrates TLS/HTTPS, AWS WAF, signed URLs, and Lambda@Edge for request customization.
- Lower latency by serving from nearby edge locations
- Reduced load and cost on the origin server
- Built-in TLS/HTTPS and AWS WAF security
- Higher availability and DDoS resilience
- Edge compute with CloudFront Functions and Lambda@Edge
AI Mentor Explanation
Instead of every fan calling the main stadium in Mumbai for the live score, local clubs in each city keep a synced scoreboard fans check nearby. CloudFront works like those local scoreboards, caching content at edge locations so users get answers from close by instead of the distant origin, and only refreshing from headquarters when the local copy is stale.
Step-by-Step Explanation
Step 1
Create a distribution
Define a CloudFront distribution and point it at an origin such as an S3 bucket, ALB, or custom server.
Step 2
Configure cache behavior
Set cache policies, TTLs, and which paths or query strings are cached versus forwarded to the origin.
Step 3
Secure the edge
Enable HTTPS with an ACM certificate, attach AWS WAF, and use Origin Access Control to lock down S3 origins.
Step 4
Route users to edges
CloudFront directs each request to the nearest edge location and serves a cache hit or fetches on a miss.
Step 5
Invalidate and monitor
Invalidate paths when content changes and monitor cache hit ratio and latency in CloudWatch.
What Interviewer Expects
- Understanding of edge locations and caching
- Difference between cache hit and cache miss
- Role of the origin (S3, ALB, custom)
- Awareness of TTLs, cache policies, and invalidations
- Security features like HTTPS, WAF, and signed URLs
Common Mistakes
- Confusing CloudFront edge locations with Availability Zones
- Forgetting to invalidate the cache after updating content
- Not using Origin Access Control to protect S3 origins
- Assuming a CDN only serves static, never dynamic, content
- Ignoring cache hit ratio when diagnosing high origin load
Best Answer (HR Friendly)
“Amazon CloudFront is AWS's content delivery network that stores copies of your website's content in data centers around the world. When someone visits, they get the content from a nearby location instead of a far-away server, so pages load faster and the main server handles less traffic.”
Code Example
# Create a distribution from a config file that points to an S3 origin
aws cloudfront create-distribution \
--distribution-config file://dist-config.json
# After updating content, invalidate cached paths at the edge
aws cloudfront create-invalidation \
--distribution-id E123ABC456DEF \
--paths "/index.html" "/assets/*"Follow-up Questions
- What is the difference between an edge location and a regional edge cache?
- How do signed URLs and signed cookies restrict content access?
- When would you use Lambda@Edge versus CloudFront Functions?
- How does Origin Access Control secure an S3 origin?
- How do TTL and cache policies affect the cache hit ratio?
MCQ Practice
1. What happens on a CloudFront cache miss?
On a miss, CloudFront retrieves the object from the origin, stores it per the cache policy, and serves it.
2. What is the main benefit of serving content from edge locations?
Edge locations are geographically close to users, reducing round-trip latency.
3. Which action forces CloudFront to drop cached copies of updated files?
An invalidation removes objects from edge caches so the next request fetches the fresh version.
Flash Cards
What is a CloudFront edge location? — A globally distributed cache point that serves content close to users.
What is a cache hit? — When the requested content is already cached at the edge and served instantly.
What can act as a CloudFront origin? — An S3 bucket, an Application Load Balancer, or a custom HTTP server.
How do you refresh cached content early? — Create an invalidation for the changed paths.