Caching
- Cache policies define the cache key and TTL behavior.
- Origin request policies control what is forwarded to the origin.
- Invalidations remove cached objects before TTL expiration.
- Versioned object names are often more scalable than frequent invalidations.
Security and Origins
- Origin Access Control is the modern way to restrict S3 origins to CloudFront.
- Signed URLs and signed cookies restrict access to private content.
- Origin failover can route to a secondary origin for selected HTTP failures.
- CloudFront logs help investigate edge requests and cache behavior.
Exam Cues
- Need block direct S3 access: use OAC and a bucket policy.
- Need private downloads: signed URLs or signed cookies.
- Need content update now: invalidation.
- Need lower origin load: tune cache policy and TTLs.
Practice CloudFront Questions
Put your knowledge to the test with practice questions.