Section Map
This section covers two AWS services that bring content and applications closer to global users through the AWS edge network. It builds on S3 Security (S3 as an origin, pre-signed URLs) and on the load balancer notes in ALB and NLB.
| # | Topic | Key Concepts |
|---|---|---|
| 01 | CloudFront Overview | CDN, 216 points of presence, edge caching, DDoS protection, S3 origin with OAC, CloudFront vs S3 Cross-Region Replication, hands-on distribution |
| 02 | CloudFront - ALB as an Origin | Custom HTTP origins, public EC2 origin, public ALB with private EC2, security group rules for edge IPs |
| 03 | CloudFront - Geo Restriction | Allowlist, blocklist, third-party Geo-IP database, copyright use case |
| 04 | CloudFront - Price Classes | Price Class All, 200, 100, per-region data-out pricing |
| 05 | CloudFront - Cache Invalidation | TTL, full or partial invalidation, path patterns |
| 06 | AWS Global Accelerator | Unicast vs Anycast IP, 2 static IPs, health checks, failover under 1 minute, vs CloudFront, hands-on |
Key Exam Topics
- CDN - anytime you see CDN on the exam, think CloudFront
- CloudFront caches content at edge locations (216 points of presence) for lower latency worldwide
- OAC (Origin Access Control) secures an S3 origin and replaces the older OAI
- CloudFront vs S3 Cross-Region Replication - global cached static content vs near real-time replication to a few regions
- Public-origin pattern: EC2 origin must be public; ALB must be public but its EC2 instances can be private. VPC origins (2024-11) now allow a private ALB, NLB or EC2
- Geo Restriction - allowlist or blocklist of countries
- Price Classes - All, 200, 100 trade performance for cost
- Cache invalidation - force a full or partial cache refresh before the TTL expires
- Global Accelerator - 2 static Anycast IPs, TCP/UDP, no caching, fast regional failover
- Global Accelerator vs CloudFront - non-HTTP and static IP use cases vs cacheable and dynamic HTTP content
AWS update (2024-11)
CloudFront VPC origins can reach ALB, NLB and EC2 in private subnets. The course said the origin must be public. AWS source
Check yourself
Quiz