What Is Amazon CloudFront and Why Use It? Edge Locations and Caching Explained
In How to Host a Static Website on S3 with CloudFront we used CloudFront once, quickly. Now we learn it properly. This chapter answers why a CDN exists, what edge locations and regional edge caches are, how a cache hit and a miss work, where CloudFront is used, and how price classes change your bill. The lab shows the speed-up with real numbers.
What you'll learn in this chapter
- Why a server in Mumbai feels slow in London and New York
- CDN, edge locations (POPs) and regional edge caches
- Cache hit vs cache miss, step by step
- Use cases and price classes
- Measure the difference with curl and X-Cache
1. A story: a Mumbai shop goes global
Priya sells handmade sarees. Her site runs on one EC2 server in Mumbai (ap-south-1). Customers in Pune say it is fast. Customers in London and New York say every page takes 2 to 3 seconds and photos load slowly.
The server is not slow. The distance is. Light in fibre takes time, and each page needs many round trips: DNS, TCP, TLS, HTML, then 30 images. Mumbai to New York is roughly 200 ms per round trip. Thirty round trips add up.
The fix: keep copies of her photos and pages in London and New York. That is a CDN.
2. What is a CDN and what is CloudFront?
Why do we need this?
You cannot run a server in every city. A CDN company already has servers in hundreds of cities and rents them to you.
What is it?
A CDN (Content Delivery Network) is a network of cache servers near users. Amazon CloudFront is AWS's CDN. Your real server is the origin (S3, an ALB, EC2, or any HTTP server). CloudFront sits in front of it and gives you a domain like d111abcd.cloudfront.net.
| Layer | What it is | Count (AWS, 2026) |
|---|---|---|
| Edge location / POP | Point of Presence: the server group a viewer connects to first | 750+ POPs, 100+ cities |
| Embedded POP | Small caches inside internet providers' networks | 1,140+ |
| Regional edge cache (REC) | Bigger mid-tier cache between POPs and your origin | 15 |
| Origin | Your real server | You choose |
3. Cache hit vs cache miss
Why do we need this?
Knowing the path tells you why the first visitor is slower and why most visitors are fast.
What is it?
The response header X-Cache tells you which one happened: Miss from cloudfront, Hit from cloudfront, or RefreshHit from cloudfront (the copy was old, the origin said it is still fine). Header X-Amz-Cf-Pop shows the POP code, like BOM78-P1 for Mumbai or LHR61-P2 for London. Age shows how many seconds the copy has been in cache.
Ravindra Bagale's Tip
Even uncached requests (APIs, logins) get faster: the TLS handshake ends at the nearby POP, and CloudFront keeps warm connections to your origin over the AWS backbone.
4. Where CloudFront is used
| Use case | Origin | Why CloudFront |
|---|---|---|
| Static website (React, Angular, Hugo) | S3 | HTTPS, private bucket, fast worldwide |
| Video courses, reels | S3 / MediaPackage | Big files cached near viewers; signed URLs for paid content |
| APIs (Node, Django, Spring, Laravel, .NET, Go) | ALB / API Gateway | TLS near users, fewer slow handshakes, WAF in front |
| Software downloads, game patches | S3 | One upload, millions of downloads, origin not overloaded |
| DDoS and attack protection | Any | AWS Shield Standard is included free; add AWS WAF rules |
| WordPress, PHP sites | EC2 / ALB | Cache /wp-content/*, pass /wp-admin/* through |
5. Price classes and cost
Why do we need this?
Serving data from some places costs AWS more. If your users are only in a few regions, you can skip the expensive edges.
What is it?
| Price class | Edges used | Pick it when |
|---|---|---|
| All | Every edge location | Users everywhere, best speed |
| 200 | North America, Europe, Israel, Middle East, Africa and most of Asia including India | India + Europe + US audience |
| 100 | North America, Europe and Israel only | Users mainly in US/Europe; lowest price |
With Price Class 100, a viewer in Pune is still served, but from a farther edge (for example in Europe), so it is slower. For an Indian audience use 200 or All.
Pay-as-you-go billing is per GB sent to viewers (the rate depends on the region) plus per 10,000 requests. The always-free tier gives 1 TB out and 10 million requests each month. AWS also offers flat-rate monthly plans (starting with a $0 Free plan) that bundle CloudFront, WAF, Route 53 DNS and S3 credits with no overage. Data from AWS origins (S3, ALB, EC2) to CloudFront has no transfer charge.
6. Worked examples
- A 2 MB hero image, 10,000 London visitors a day. Without CDN: 10,000 trips to Mumbai. With CloudFront: 1 trip per POP, the rest are HITs.
- An API on an ALB in Mumbai, called from New York. Not cacheable, but TLS ends in New York and the request rides the AWS backbone: often 30 to 50 percent faster first byte.
- A 500 MB installer downloaded 100,000 times: origin serves it a few dozen times; CloudFront serves the rest.
7. Lab: CloudFront in front of an S3 image
How to do it (step by step)
You need an AWS account and CloudShell (or a laptop with curl). Region ap-south-1.
- S3 › Create bucket: name
yourname-cf-lab, Region ap-south-1, keep Block all public access on. Why: CloudFront will read it privately. - Upload a photo of about 1 MB:
aws s3 cp photo.jpg s3://yourname-cf-lab/img/photo.jpg. - CloudFront › Create distribution. Origin domain: pick
yourname-cf-lab.s3.ap-south-1.amazonaws.com. - Origin access: Origin access control settings (recommended) › Create new OAC › defaults › Create.
- Viewer protocol policy: Redirect HTTP to HTTPS. Cache policy: CachingOptimized. Why: a good default for static files.
- Web Application Firewall: Do not enable security protections (lab only). Price class: Use North America, Europe, Asia, Middle East and Africa (that is 200).
- Create distribution. Click Copy policy in the yellow banner, open the bucket › Permissions › Bucket policy › paste › Save.
- Wait until Last modified shows a date (not Deploying). Copy the domain, e.g.
d111abcd.cloudfront.net. - First request:
curl -sI https://d111abcd.cloudfront.net/img/photo.jpg | grep -iE "x-cache|x-amz-cf-pop|age". Expected:X-Cache: Miss from cloudfront. - Run it again. Expected:
Hit from cloudfrontand anAgeheader. - Time it:
curl -so /dev/null -w "total %{time_total}s\n" https://d111abcd.cloudfront.net/img/photo.jpg. Run 3 times and note the numbers. - Compare with S3 directly using a pre-signed link:
U=$(aws s3 presign s3://yourname-cf-lab/img/photo.jpg --region ap-south-1); curl -so /dev/null -w "total %{time_total}s\n" "$U". Why: the bucket is private, so a plain URL would give 403. - Best test: run both commands from CloudShell in a far Region, such as us-east-1 or eu-west-2. Expected: CloudFront HITs are several times faster than S3 Mumbai.
Cleanup
- CloudFront › select the distribution › Disable. Wait until it is disabled, then Delete.
aws s3 rb s3://yourname-cf-lab --force. Delete the OAC under CloudFront › Origin access.
8. Interview questions
Q. What is CloudFront?
AWS's CDN. It caches content at edge locations near viewers and fetches from your origin on a miss.
Q. Edge location vs regional edge cache?
The edge (POP) is where viewers connect. The REC is a larger mid-tier cache between POPs and the origin, so fewer requests reach the origin.
Q. How do you know if a response came from cache?
The X-Cache header: Hit from cloudfront or Miss from cloudfront. Age shows seconds in cache.
Q. Does CloudFront help APIs that cannot be cached?
Yes. TLS ends near the user and traffic uses the AWS backbone with reused origin connections.
Q. Which price class for an India-first audience?
Price Class 200 or All. Price Class 100 has no Indian edges.
Try at home
- Repeat the timing test from three Regions and make a small table.
- Find the POP code in X-Amz-Cf-Pop and match the first three letters to an airport code.
In short
- Distance, not server power, makes far users slow.
- CloudFront = CDN: POPs near users, RECs in the middle, your origin behind.
- HIT = served from cache; MISS = fetched from origin; X-Cache tells you.
- Price class 100/200/All trades cost for reach; India needs 200 or All.
Practice Tasks
Seoul Beauty Lab is a cosmetics business in Seoul. Ji-woo Park looks after its IT and cloud work. They count money in KRW and run their AWS resources in the ap-northeast-2 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.
0 / 10
Easy List distributions
Why: Find the distribution ID and domain name.
What to do: List all CloudFront distributions.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy How many addresses in a /16?
Why: Picking a VPC size needs this count.
What to do: Seoul Beauty Lab plans the VPC 10.71.0.0/16. How many IP addresses does it hold in total?
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Easy Port for SSH
Why: Security group rules need the right port.
What to do: Which TCP port must the security group open for SSH?
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Medium Clear the CloudFront cache
Why: After a deploy, invalidate so visitors get the new files now, not after the TTL.
What to do: Invalidate all paths (/*) on distribution E2QWRUHAPOMQZL.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Create a distribution from a config file
Why: The full config (origins, behaviors, certificate) is easiest to keep in JSON.
What to do: Create a CloudFront distribution from dist.json.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Invalidate two paths
Why: Invalidating only what changed is cheaper and faster.
What to do: On E2QWRUHAPOMQZL, invalidate /index.html and /css/site.css.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Bucket policy for CloudFront OAC
Why: With OAC, only your CloudFront distribution may read the private bucket.
What to do: Allow the service cloudfront.amazonaws.com to s3:GetObject on seoulbeauty-site/*, only when aws:SourceArn equals arn:aws:cloudfront::119519391020:distribution/E2QWRUHAPOMQZL.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Hard Create an Origin Access Control
Why: OAC lets only CloudFront read your private S3 bucket.
What to do: Create an origin access control from oac.json.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Request a free certificate for CloudFront
Why: CloudFront only uses ACM certificates from us-east-1. DNS validation renews automatically.
What to do: Request a certificate for seoulbeauty.kr and www.seoulbeauty.kr with DNS validation, in us-east-1.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Make a CloudFront signed URL
Why: Signed URLs let only paying users watch a video, for a limited time.
What to do: Sign https://d111.cloudfront.net/course/intro.mp4 with key pair ID K2JCJMDEHXQW5F, private key private_key.pem, expiring 2026-12-31.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Revision, comparison and interview cards
Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.
More cards: Ravi Sir's Cards.