Amazon CloudFront
Also known as: CF, CloudFront CDN, CloudFront distribution, Lambda@Edge, CloudFront Functions
CloudFront is AWS's CDN.
When you configure CloudFront in front of your website or API, it caches your content at 400+ edge locations globally. Users are served from the nearest edge node, reducing latency. CloudFront integrates deeply with other AWS services -- S3, EC2, Lambda@Edge -- and handles SSL, DDoS mitigation, and custom headers.
Amazon CloudFront, explained at three levels
At home
CloudFront copies your website's files to servers all over the world. When a user in Japan visits your US-hosted website, they get files from a CloudFront server in Tokyo instead of waiting for a transatlantic trip. This makes pages load faster everywhere.
At work
CloudFront reduces load on your origin server and speeds up content delivery globally. Images, videos, and static files are cached at edge locations; your origin only handles dynamic requests that can't be cached. It also absorbs DDoS traffic before it reaches your servers.
At home
CloudFront distributions have an origin (S3 bucket, EC2, ALB, or custom HTTP server) and edge cache behaviors. Cache behavior rules (based on URL path) control TTL, header forwarding, and compression. HTTPS is default (no extra cost). Price classes let you limit edge locations to reduce costs. Invalidations clear cached objects before TTL expires.
At work
CloudFront integrates with AWS WAF (Web Application Firewall) for application-layer protection, Shield Standard for DDoS mitigation, ACM (AWS Certificate Manager) for free SSL certificates, and Route 53 for DNS. Lambda@Edge functions run at edge locations in response to CloudFront events (viewer request/response, origin request/response) -- enabling authentication, URL rewrites, A/B testing, and dynamic content manipulation.
At home
CloudFront uses Anycast routing to direct users to the nearest edge PoP (Point of Presence). Cache keys determine uniqueness (URL path, query strings, headers, cookies). Signed URLs and Signed Cookies restrict access to authorized users. Field-Level Encryption protects sensitive form fields end-to-end from CloudFront through the origin.
At work
CloudFront's Origin Shield is an additional caching layer between edge locations and the origin, collapsing cache misses from multiple edges into single origin requests -- critical for high-traffic origins with expensive data generation. Real-time logs via Kinesis Data Streams enable sub-second analytics on CloudFront access patterns. CloudFront Continuous Deployment allows testing new cache behaviors on a percentage of traffic before full deployment.
Real-world examples
At home
Aisha's podcast hosting uses S3 for audio files and CloudFront in front of it. International listeners get files from the nearest CloudFront edge -- her Tokyo listeners download at the same speed as her Toronto listeners, without her running multiple servers.
At work
Marcus's team deployed their SaaS application with CloudFront handling the frontend (React app from S3), API acceleration (passing dynamic requests to ALB), and Lambda@Edge for JWT authentication validation at the edge -- rejecting unauthenticated requests before they hit origin servers.
Common confusions
- CloudFront only serves static files — CloudFront can accelerate dynamic content by leveraging TCP connection reuse to the origin, compression, and protocol optimizations. Lambda@Edge enables server-side logic at the edge. CloudFront handles WebSocket connections and streaming media, not just static assets.
- CloudFront and S3 are the same service — S3 stores files; CloudFront distributes them globally. They work together, but S3 serves content from one region while CloudFront replicates it to 400+ edge locations. Serving S3 content directly without CloudFront is slower for international users and exposes origin S3 URLs.
For analysts
CloudFront access logs and real-time metrics (cache hit ratio, request volume by geography, error rates) provide business insights about content performance and user geography -- useful for evaluating CDN ROI and content strategy.
History & origin
Amazon launched CloudFront in 2008, one of the earlier cloud services. It was positioned to compete with Akamai and Limelight as a CDN for AWS customers. CloudFront expanded from static content delivery to support dynamic content acceleration, WebSocket, Lambda@Edge (2016) for server-side logic at the edge, and CloudFront Functions (2021) for lightweight JavaScript at sub-millisecond latency.