CloudFront

What it is

Amazon CloudFront is AWS's content delivery network. It serves websites, APIs and files from edge locations around the world, so a visitor is answered from somewhere close instead of from one far-off server. It caches what it can, terminates TLS at the edge, and passes the rest through to an origin such as an S3 bucket, a load balancer or a Lambda function URL.

Beyond caching, CloudFront applies policies at the edge: which headers reach the origin, which security headers go back to the browser, and who can reach the origin at all. CloudFront Functions run small pieces of JavaScript at the edge for redirects, header changes or quick answers, without calling a server.

How I use it

• One distribution fronts all of mervinc.com: a private S3 origin for the pages and Lambda function URLs for the dynamic half, reachable only through CloudFront.
• A response headers policy adds HSTS, a hash-only Content Security Policy and Server-Timing, which the glass box reads to show which edge served you.
• A CloudFront Function with a KeyValueStore answers an edge hello and reads feature switches I flip from my phone, without calling any server.
• The Rental Pilot web app and customer portal are served from S3 through CloudFront. Every deploy syncs, invalidates and runs a smoke suite against production.
• Small client sites like Rail & Sail Montessori House run on S3 and CloudFront with HTTPS enforced.

CloudFront is the right front door for almost any web property on AWS. It makes static sites fast and cheap, keeps origins private, and puts security headers where no app build can forget them. I put it in front of everything I run on AWS, including sites that cost well under a dollar a month to host.

Questions