Certablo
Sign inCreate account
← Knowledge Base
Networking & Deliveryservice

Amazon CloudFront & Edge Caching

AWS content delivery at the edge: distributions, origins, cache behavior, cache keys, TTL controls, cache hit/miss flow and how CloudFront differs from DNS and Global Accelerator.

CLF-C02

Visual overview

EDGE CACHE PATHServe a cache hit nearby; fetch from the origin only when the representation is absent or stale
01ViewerHTTPS request
→
02Edge cacheEvaluate cache key + validity
→
03Regional edgeAdditional cache layer on miss
→
04OriginS3 · ALB · HTTP server
Cache keyPath + selected query/header/cookie valuesFreshnessMin / default / max TTL + origin cache headers
Cache-key design directly affects hit ratio: unnecessary request attributes can fragment otherwise reusable cached content.
AWS SERVICE MAPCache HTTP content near viewers

Route 53 can resolve the distribution; CloudFront serves cached objects or retrieves them from an origin such as S3.

Route 53Resolve name
CloudFrontEdge cache
Amazon S3Origin
EXAM-RELEVANT MECHANICS

Technical reference

Edge caching is controlled primarily by cache-key composition and freshness policy.

Cache keyPath + selected request values

Selected query strings, headers and cookies can create distinct cached variants.

TTL controlsMinimum · default · maximum

Cache policy bounds interact with origin Cache-Control/Expires headers.

Cache missEdge → origin path

CloudFront retrieves uncached/stale content and can store it for later viewers.

InvalidationExpire paths early

Selected cached paths can be invalidated before their normal expiration when required.

A CDN puts reusable responses closer to viewers

Amazon CloudFront is AWS's content delivery network (CDN). A distribution describes how CloudFront should receive viewer requests and forward them toward one or more origins such as Amazon S3, Elastic Load Balancing or HTTP servers. Viewers connect to edge locations (points of presence); if the requested representation is cached and valid, CloudFront can return it without making the origin perform the same work again.

On a cache miss, CloudFront retrieves the content through its delivery network and origin path, returns the response and can cache the result according to cache behavior. Regional edge caches provide an additional caching layer in the request hierarchy. This reduces latency for repeated content and can lower origin load, but dynamic or personalized data requires a deliberate cache design rather than assuming every HTTP response should be shared.

The cache key determines whether two requests share an object

CloudFront builds a cache key from request attributes. The distribution domain and URL path are part of the default key; cache policies can include selected query strings, headers and cookies. If two requests produce different cache keys, CloudFront may store separate cached variants even when the origin would return identical content. Including unnecessary high-cardinality attributes therefore reduces cache-hit ratio and increases origin work.

A cache policy also controls minimum, default and maximum time to live (TTL). Origin Cache-Control and Expires headers interact with those policy boundaries. TTL design is a correctness-versus-freshness decision: long caching reduces origin calls but may retain content longer, while short caching keeps content fresher at the cost of more origin requests. Invalidation provides an explicit mechanism to expire selected cached paths before normal expiration when required.

CloudFront is more than a static-file shortcut

CloudFront can deliver static and dynamic HTTP(S) content and integrates with AWS security and edge capabilities. HTTPS, origin access controls for supported S3 patterns, AWS WAF and AWS Shield integrations can place protection close to the internet-facing edge. Signed URLs and signed cookies can support restricted content distribution when applications need controlled viewer access.

CloudFront pricing depends on current request, transfer and feature dimensions and varies by architecture, so cost comparisons should use current AWS pricing. Architecturally, the most important question is whether HTTP content benefits from edge caching and delivery. Route 53 resolves DNS names, while Global Accelerator routes supported TCP/UDP traffic through the AWS global network using static anycast addresses; these services can complement CloudFront but solve different layers.

Key takeaways

  1. 01

    CloudFront is a CDN: edge caches can serve content without repeatedly calling the origin.

  2. 02

    Cache keys decide which requests share cached objects; unnecessary headers, cookies or query strings can reduce hit ratio.

  3. 03

    Cache policies bound TTL behavior and interact with origin cache-control headers.

  4. 04

    Route 53 handles DNS, CloudFront handles HTTP content delivery/caching, and Global Accelerator optimizes supported IP traffic paths.

Official AWS sources

Use these primary AWS resources for the source material behind this article and for deeper reference.