Amazon CloudFront and WAF: CDN, HTTPS and Web Firewall Explained
Your website is in Mumbai S3, but a user in Europe waits. CloudFront copies popular files to edge locations closer to users. WAF sits in front to block common web attacks and noisy bots. CDN for speed; WAF for punches you do not want.
What you'll learn in this chapter
- Why CDN + WAF together
- CloudFront distributions, origins, behaviors
- HTTPS certificates and price classes
- AWS WAF rules and Bot Control basics
- Lab, errors, FAQ, interview
1. Everyday example first
An education site launches a PDF exam guide. Without CloudFront every download hits the origin. With CloudFront, the first reader warms the edge; the next thousand are cheap and fast. WAF rate rules stop a scraper from downloading the whole library.
2. Why CloudFront and WAF?
Why do we need this?
Latency and DDoS/L7 abuse are different problems. CloudFront shortens distance and absorbs some volumetric noise. WAF inspects HTTP and applies managed or custom rules. Most public apps want both.
3. What is CloudFront?
What is it?
A distribution points to origins (S3, ALB, custom). Behaviors map path patterns to cache policies and origin request policies. Viewers can be forced to HTTPS with ACM certificates (usually us-east-1 for CloudFront).
| Piece | Role |
|---|---|
| Distribution | The CDN config unit |
| Origin | Where content lives |
| Behavior | Path → cache/origin rules |
| WAF Web ACL | Rules attached to distribution |
4. How to set up (checklist)
How to do it (step by step)
- Create ACM cert in us-east-1 for your domain.
- Create distribution; origin = S3 REST or ALB.
- Redirect HTTP to HTTPS; TLS 1.2+.
- Attach AWS WAF Web ACL with AWS managed core rule set.
- Add rate-based rule for login paths.
- Enable access logs to S3 for forensics.
# Cache mental model
# /static/* → long TTL, compress, query strings ignored
# /api/* → CachingDisabled, forward headers carefully
# /login → WAF rate limit + no cache5. Industries
- Media: video/image edges
- Fintech portals: WAF on login + CDN for static
- Gov sites: managed rules + logging
- SaaS marketing sites: price class to control cost
6. Lab: design behaviors on paper + console tour
Do this in ap-south-1 (Mumbai) unless your org forbids it. Set a budget alert first.
How to do it (step by step)
- List three path patterns for a sample app.
- Open CloudFront console (read-only) and note price classes.
- Open WAF console; read AWSManagedRulesCommonRuleSet description.
- Write which paths should CachingDisabled.
- Sketch IAM for log bucket.
Cleanup (stop billing)
- If you created a test distribution, disable then delete.
- Delete test Web ACL if empty.
7. Common errors and fixes
Each row is a real mistake students and juniors hit. Read the fix before you panic.
| Error / symptom | Fix |
|---|---|
| ACM cert in Mumbai for CloudFront | CloudFront needs us-east-1 cert. |
| S3 website endpoint + OAC confusion | Prefer S3 REST + OAC. |
| Cached HTML forever after deploy | Version assets; invalidate carefully. |
| WAF blocks legitimate traffic | Tune; count mode first. |
| Price class All when India-only | Pick nearer classes to save. |
| No WAF on API via CloudFront | Attach Web ACL. |
| Forwarded all cookies → low cache hit | Forward only needed cookies. |
| Origin SG closed to CloudFront | Use managed prefix lists / OAC patterns. |
| Logged PII in query strings | Redact; avoid tokens in query. |
| Single origin no failover | Add secondary origin group. |
8. Troubleshooting checklist
- 403 from S3: OAC/bucket policy.
- Cert not listed: wrong ACM region.
- WAF 403: check sampled requests.
- High origin traffic: cache policy too strict.
- DNS not pointing to distribution domain.
- HTTP/2 or TLS issues: security policy.
9. FAQ
Q. CloudFront vs ALB only?
ALB is regional; CloudFront is global edge.
Q. Is WAF enough vs Shield?
WAF=L7 rules; Shield=DDoS; often combine.
Q. Invalidations cost?
Yes after free tier — prefer versioned objects.
Q. Bot Control?
Advanced WAF feature for bots — costs extra.
Q. Can WAF protect API Gateway?
Yes — associate Web ACL.
10. Interview Q&A
Q. What does CloudFront do?
CDN that caches at edges and fronts origins.
Q. Origin Access Control?
Lets CloudFront fetch private S3 securely.
Q. Why us-east-1 ACM?
CloudFront global cert store requirement.
Q. WAF rule types?
Managed, custom, rate-based, Bot Control.
Q. Cache hit ratio low?
Review TTLs, query strings, cookies, headers.
Q. Defense in depth?
Shield + WAF + least privilege origin.
11. Tips in English, Marathi and Hindi
Ravindra Bagale's Tip (EN)
Version static filenames (app.a1b2.js). Invalidations are a tax on poor naming.
Ravindra Bagale's Tip (MR)
Static filenames version करा. Invalidation = poor naming tax.
Tip (HI)
Static फाइल नाम version करो — invalidation खराब नामकरण का टैक्स है।
Try at home
- curl -I a CDN URL and read cache headers (x-cache).
- List five WAF managed rule groups from docs titles.
- Draw Viewer → Edge → Origin with WAF box.
In short
- CloudFront = CDN edges + origins + behaviors.
- WAF = HTTP rules on the distribution.
- HTTPS certs for CF usually from us-east-1 ACM.
- Tune cache and WAF with logs, not guesses.
Revision, interview and comparison cards
Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.
More cards: Ravi Sir's Cards.
Practice Tasks
Milan Furniture is a furniture business in Milan. Giulia Rossi looks after its IT and cloud work. They count money in EUR and run their AWS resources in the eu-south-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.
0 / 16
Easy List distributions
Why: See CDNs.
What to do: List CloudFront distributions.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy List web ACLs CLOUDFRONT
Why: Scope CLOUDFRONT.
What to do: List web ACLs with scope CLOUDFRONT.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy List tags for distribution
Why: Cost allocate CDN.
What to do: List tags for arn:aws:cloudfront::126154182628:distribution/E123EXAMPLE.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy List origin bucket objects
Why: Check origin objects.
What to do: List objects in bucket milanfurniture-origin.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy ACM region for CF — enter 1 if us-east-1
Why: Global cert store.
What to do: Enter 1 if CloudFront ACM certs are usually from us-east-1.
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Easy WAF is L7 — enter 7
Why: Layer 7.
What to do: Which OSI layer does WAF mainly filter? Enter 7.
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Easy Force HTTPS — enter 1
Why: Redirect viewers.
What to do: Enter 1 if viewers should be redirected to HTTPS.
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Medium Get distribution
Why: Inspect origins.
What to do: Get distribution E123EXAMPLE.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Get web ACL
Why: See rules.
What to do: Get web ACL Name lab Id abcd Scope CLOUDFRONT.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium List certs us-east-1
Why: CF certs region.
What to do: List certificates.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Allow WAF logging write
Why: Forensics.
What to do: Allow logs:CreateLogStream on arn:aws:logs:eu-south-1:126154182628:log-group:/aws/waf/*.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Medium Behavior JSON
Why: Path to cache policy.
What to do: JSON PathPattern /static/* TTL 86400.
- Start from the top-level keys the task names.
- Indent child keys with 2 spaces (no tabs).
- Fill in each property with the value from the task.
- Click Check answer. Key order does not matter.
Medium Price classes roughly 3
Why: Cost control.
What to do: About how many CloudFront price class choices are commonly discussed (enter 3)?
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Hard Create invalidation
Why: Clear stale HTML carefully.
What to do: Create invalidation on E123EXAMPLE for path /index.html.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Deny non-CloudFront S3 get sketch
Why: Bucket not public.
What to do: Deny s3:GetObject on arn:aws:s3:::milanfurniture-origin/* (Effect Deny).
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Hard Rate rule JSON
Why: Login abuse.
What to do: JSON Limit 100 Path /login.
- Start from the top-level keys the task names.
- Indent child keys with 2 spaces (no tabs).
- Fill in each property with the value from the task.
- Click Check answer. Key order does not matter.