Study guide
13.3 Global Content & Service Distribution: CloudFront & Global Accelerator
AWS Certified CloudOps Engineer – Associate SOA-C03
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Monitoring & Observability Infrastructure
1.1 Configuring Workload Observability 1.2 CloudWatch Agent Architecture & Deployment 1.3 Metric Alarms, Anomaly Detection & Composite Alarms
2 Chapter 2: Alarms, Dashboards & Event-Driven Remediation
2.1 CloudWatch Dashboards & Multi-Account Visibility 2.2 Notification Architecture & Alarm Invocation 2.3 Amazon EventBridge Rules, Event Buses & Troubleshooting 2.4 Automated Remediation with Systems Manager & Lambda
3 Chapter 3: Performance Optimization for Compute, Storage & Databases
3.1 EC2 & Compute Performance Optimization 3.2 Amazon EBS Performance Metrics & Volume Tuning 3.3 S3 Performance Strategies & Data Transfer 3.4 Shared Storage (EFS/FSx) & Database Performance
4 Chapter 4: Compute & Database Scalability and Elasticity
4.1 EC2 Auto Scaling Policies & Elasticity 4.2 Auto Scaling Advanced Operations: Warm Pools & Lifecycle Hooks 4.3 Dynamic Scalability Through Caching 4.4 Managed Database Scaling: RDS, Aurora & DynamoDB
5 Chapter 5: High Availability, Fault Tolerance & Load Balancing
5.1 Elastic Load Balancing (ALB/NLB) Configuration & Troubleshooting 5.2 Route 53 Health Checks & DNS Failover 5.3 Multi-AZ Architecture & Fault-Tolerant Deployments
6 Chapter 6: Backup, Data Protection & Disaster Recovery
6.1 Centralized Backup Automation & AWS Backup 6.2 Database Restore Strategies & RTO/RPO Management 6.3 Storage Versioning, Replication & Immutability 6.4 Disaster Recovery Patterns & Multi-Region Resilience
7 Chapter 7: Infrastructure as Code with CloudFormation & AWS CDK
7.1 CloudFormation Foundations & Resource Modeling 7.2 Managing Stacks, Drift Detection & Change Sets 7.3 Infrastructure as Code with AWS CDK 7.4 Identifying & Remediating Deployment Failures
8 Chapter 8: Multi-Account Provisioning, Containers & Third-Party IaC
8.1 Golden Images with EC2 Image Builder & Amazon ECR 8.2 Multi-Account & Multi-Region Resource Sharing 8.3 Deployment Strategies & Container Deployments 8.4 Third-Party Automation with Terraform & Git Workflows
9 Chapter 9: Systems Manager & Event-Driven Operations Automation
9.1 AWS Systems Manager Core Management & Run Command 9.2 Systems Manager Patch Manager & Session Manager 9.3 Event-Driven Operations Automation
10 Chapter 10: Identity, Access Management & Governance
10.1 Advanced IAM Policies, Roles & Policy Conditions 10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer 10.3 Multi-Account Security: Organizations, SCPs & Identity Center 10.4 Compliance Enforcement with AWS Config & Conformance Packs
11 Chapter 11: Data Security, Encryption & Vulnerability Management
11.1 Data Classification & Amazon S3 Security 11.2 Encryption at Rest with AWS Key Management Service (KMS) 11.3 Encryption in Transit with AWS Certificate Manager (ACM) 11.4 Secrets Management & Centralized Security Findings
12 Chapter 12: VPC Architecture, Endpoints & Network Protection
12.1 VPC Core Architecture, Subnetting & High Availability NAT 12.2 Private Network Connectivity: VPC Endpoints & Peering 12.3 Network Protection & Edge Security Auditing
13 Chapter 13: DNS, Route 53 Routing & Content Delivery
13.1 DNS Architecture & Route 53 Resolver for Hybrid Clouds 13.2 Route 53 Advanced Routing Policies & Query Logging 13.3 Global Content & Service Distribution: CloudFront & Global Accelerator
14 Chapter 14: Network Troubleshooting, Traffic Analysis & Hybrid Connectivity
14.1 VPC Configuration Troubleshooting & Analysis Tools 14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics 14.3 CloudFront Caching & Hybrid Connectivity Troubleshooting
13.3 Global Content & Service Distribution: CloudFront & Global Accelerator
Key Takeaways Explain This Topic AI
Amazon CloudFront accelerates content delivery across 750+ Points of Presence (POPs) and Regional Edge Caches, with Origin Shield providing an optional centralized caching tier that consolidates cache misses and reduces origin load and egress fees.
Origin Access Control (OAC) replaces legacy OAI, supporting SSE-KMS encryption with customer managed keys, dynamic HTTP methods (PUT/POST/DELETE), and all AWS Regions through SigV4 signing.
Cache Policies define the Cache Key (headers, cookies, query strings) and TTL parameters to maximize cache hit ratios, while Origin Request Policies pass viewer headers to origins without fragmenting the cache.
CloudFront Functions deliver sub-millisecond, lightweight JavaScript execution at CloudFront's 750+ POPs for viewer header rewrites and cache key normalization, whereas Lambda@Edge runs full Node.js/Python at Regional Edge Caches for heavy compute and network calls.
AWS Global Accelerator uses Anycast static IP addresses to route TCP/UDP traffic directly onto the AWS global private fiber network without caching, taking an unhealthy endpoint out of service in less than one minute for multi-Region failover.
Last updated: October 2026
13.3 Global Content & Service Distribution: CloudFront & Global Accelerator
CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to optimize global application performance, secure origin infrastructure, and design high-availability delivery architectures. CloudOps engineers must master Amazon CloudFront edge topology, protect origins using Origin Access Control (OAC) with KMS encryption, optimize caching efficiency using Cache and Origin Request policies, implement edge compute (CloudFront Functions vs. Lambda@Edge), and differentiate between CloudFront and AWS Global Accelerator for non-HTTP and static IP workloads.
Amazon CloudFront Global Architecture
Amazon CloudFront is a global Content Delivery Network (CDN) service that securely delivers data, videos, applications, and APIs to users with low latency and high transfer speeds. CloudFront terminates TLS connections close to viewers and caches content across a multi-tier global infrastructure:
Points of Presence (PoPs) / Edge Locations: More than 600 geographically distributed Points of Presence located in major metropolitan areas worldwide. Edge locations terminate viewer connections, inspect TLS certificates, evaluate AWS WAF rules, run CloudFront Functions, and serve cached responses.
Regional Edge Caches (REC): A mid-tier caching layer of 15 RECs situated within AWS Regions. Regional Edge Caches possess significantly larger storage capacities than individual edge locations. When an edge location experiences a cache miss, it queries its nearest Regional Edge Cache before forwarding the request to the origin. RECs retain less frequently requested long-tail content, preventing cache evictions and reducing origin fetch volume.
Distribution Types: CloudFront supports Web Distributions delivering HTTP/1.1, HTTP/2, and HTTP/3 (over QUIC). Legacy RTMP distributions for streaming media are fully deprecated.
Origins & Origin Shielding
CloudFront acts as a reverse proxy in front of one or more Origins :
Supported Origins: Amazon S3 buckets, Elastic Load Balancers (ALB/NLB), Amazon EC2 instances, AWS Elemental MediaStore, Amazon API Gateway, or custom on-premises web servers.
Origin Groups & Failover: CloudFront supports Origin Groups containing a primary origin and a secondary origin. If the primary origin returns specific HTTP error status codes (e.g., 500, 502, 503, 504, or connection timeouts), CloudFront automatically fails over to the secondary origin.
Amazon CloudFront Origin Shield
When an application experiences high global request volumes across dozens of edge locations simultaneously, multiple edge locations and RECs may fetch the exact same object from the origin concurrently (the "thundering herd" phenomenon), causing origin performance degradation and high cross-region data transfer fees.
Origin Shield is an additional, centralized caching layer that you explicitly configure within the Regional Edge Cache closest to your origin:
All cache misses from every edge location and Regional Edge Cache worldwide are routed through this single Origin Shield REC .
The Origin Shield REC consolidates requests, serves cached content, and forwards only a single request to the origin for any cache miss.
Operational Benefits: Origin Shield dramatically increases cache hit ratios, protects backend databases and application servers from traffic spikes, and minimizes cross-region data transfer egress costs. +---------------------------------------------------------------------------------------------------+
- | CLOUDFRONT MULTI-TIER CACHING TOPOLOGY |
- | |
- | Global Viewers |
- | | |
- | v |
- | +-------------------------------------------------------------+ |
- | | Edge Locations (750+ Global PoPs) | <-- Runs CloudFront Functions |
- | | (Viewer TLS Termination, Caching, AWS WAF inspection) | |
- | +------------------------------+------------------------------+ |
- | | Cache Miss |
- | v |
- | +-------------------------------------------------------------+ |
- | | Regional Edge Caches (RECs - 15 Global Hubs) | <-- Runs Lambda@Edge |
- | | (Large-capacity caching for long-tail assets) | |
- | +------------------------------+------------------------------+ |
- | | Cache Miss |
- | v |
- | +-------------------------------------------------------------+ |
- | | ORIGIN SHIELD (Designated Central REC) | <-- Consolidates global fetches |
- | +------------------------------+------------------------------+ |
- | | Single Origin Fetch |
- | v |
- | +-------------------------------------------------------------+ |
- | | ORIGIN INFRASTRUCTURE (Amazon S3 / Application Load Balancer)| |
- | +-------------------------------------------------------------+ |
- +---------------------------------------------------------------------------------------------------+
- Origin Access Control (OAC) vs. Legacy Origin Access Identity (OAI)
When using Amazon S3 as a CloudFront origin, public read access on the bucket must be completely disabled. To ensure that users access objects strictly through CloudFront, AWS previously used Origin Access Identity (OAI) , which is now legacy and deprecated in favor of Origin Access Control (OAC) .
Why OAI Is Deprecated
No KMS CMK Support: OAI cannot download S3 objects encrypted with AWS KMS Customer Managed Keys (SSE-KMS); it only supports default SSE-S3 encryption.
HTTP Method Limitations: OAI is restricted strictly to GET and HEAD requests; it does not support PUT , POST , or DELETE methods.
Regional Incompatibility: OAI cannot be used in AWS Regions launched after December 2022 (e.g., ap-south-2 , eu-central-2 , me-central-1 ).
Origin Access Control (OAC) Capabilities
Comprehensive Region Support: Supports all AWS Regions, both current and future.
SSE-KMS Encryption Support: OAC natively passes the CloudFront distribution identity and AWS Signature Version 4 (SigV4) headers to AWS KMS, allowing CloudFront to decrypt S3 objects protected by Customer Managed Keys.
Dynamic HTTP Methods: Fully supports dynamic writes ( PUT , POST , PATCH , DELETE ) to S3.
Granular Least Privilege: Integrates with AWS IAM resource policies using service principals and explicit condition keys.
Configuring OAC with S3 Bucket Policies & KMS
To implement OAC, the CloudOps engineer creates an OAC profile in CloudFront, attaches it to the S3 origin, and configures an S3 Bucket Policy granting access exclusively to the CloudFront distribution ARN via aws:SourceArn : {
- "Version": "2012-10-17",
- "Statement": [
- {
- "Sid": "AllowCloudFrontServicePrincipalReadOnly",
- "Effect": "Allow",
- "Principal": {
- "Service": "cloudfront.amazonaws.com"
- },
- "Action": "s3:GetObject",
- "Resource": "arn:aws:s3:::corp-production-assets/*",
- "Condition": {
- "StringEquals": {
- "aws:SourceArn": "arn:aws:cloudfront::111122223333:distribution/EDFDVBD6EXAMPLE"
- }
- }
- }
- ]
- }
If the S3 bucket is encrypted using an AWS KMS Customer Managed Key , the KMS key policy must also authorize the CloudFront service principal: {
- "Sid": "AllowCloudFrontKMSDecryption",
- "Effect": "Allow",
- "Principal": {
- "Service": "cloudfront.amazonaws.com"
- },
- "Action": ["kms:Decrypt", "kms:GenerateDataKey*"],
- "Resource": "*",
- "Condition": {
- "StringEquals": {
- "aws:SourceArn": "arn:aws:cloudfront::111122223333:distribution/EDFDVBD6EXAMPLE"
- }
- }
- }
- Cache Policies vs. Origin Request Policies
In modern CloudFront architectures, request processing behavior is decomposed into distinct, reusable policies:
Cache Policies
A Cache Policy defines what values from a viewer request are included in the Cache Key , as well as the object's Time-To-Live (TTL):
Cache Key Elements: Headers, Cookies, and Query Strings. If an element is included in the cache key, CloudFront stores separate cached variations of the object for each distinct combination of values.
Golden Rule of Caching: Minimize cache key parameters. Including unnecessary headers (e.g., User-Agent ) creates thousands of unique cache keys for identical files, causing cache fragmentation and plummeting the Cache Hit Ratio to near zero.
TTL Configuration: Defines Minimum TTL, Maximum TTL, and Default TTL (used when the origin does not return Cache-Control headers).
Origin Request Policies
An Origin Request Policy determines which viewer request headers, cookies, and query strings are forwarded to the origin on a cache miss, without including them in the Cache Key:
Operational Power: Allows backend application servers to receive critical context (such as viewer device headers, custom authorization headers, or user session cookies) while maintaining a clean, unfragmented Cache Key.
Response Headers Policies
A Response Headers Policy instructs CloudFront to inject HTTP headers into the response sent to viewers without altering origin code. It is the architectural standard for enforcing security headers (such as Strict-Transport-Security [HSTS], Content-Security-Policy [CSP], and X-Frame-Options ) and managing Cross-Origin Resource Sharing (CORS).
Edge Compute: CloudFront Functions vs. Lambda@Edge
CloudFront provides two serverless compute options at the edge to customize content delivery, enforce security, and manipulate HTTP traffic.
- Architectural Dimension CloudFront Functions Lambda@Edge
- Runtime & Language Lightweight JavaScript (ECMAScript 5.1 compliant) Node.js and Python
- Execution Location 750+ CloudFront POPs (edge locations) 15 Regional Edge Caches (RECs)
Event Triggers Viewer Request, Viewer Response Viewer Request, Origin Request, Origin Response, Viewer Response
- Execution Latency Sub-millisecond (< 1 ms); immediate start Milliseconds to seconds (cold start possible)
- Maximum Execution Time 1 millisecond 5 seconds (viewer triggers) / 30 seconds (origin triggers)
- Maximum Memory 2 MB 128 MB to 10,240 MB (10 GB)
Network & Filesystem Access None (isolated sandbox; cannot make HTTP calls) Full access (network calls to VPC/internet APIs, /tmp disk)
Request Body Access No access Full access (read and modify request/response bodies)
Cost Profile Extremely low cost (~1/6th of Lambda@Edge); millions of RPS Standard serverless pricing based on duration and memory
Primary Use Cases URL rewrites/redirects, cache key normalization, header manipulation Heavy authorization (JWT/OAuth), dynamic origin routing, SSR, image resizing
AWS Global Accelerator vs. Amazon CloudFront
Both services leverage AWS's global network infrastructure to improve application performance, but they solve fundamentally different operational problems.
AWS Global Accelerator Architecture
Static Anycast IP Addresses: Global Accelerator provisions two static Anycast IPv4 addresses that act as fixed entry points for your application worldwide.
Private Backbone Ingress: Anycast routes client traffic to the topologically closest AWS edge location. From the edge, traffic enters the AWS private fiber-optic backbone network directly, bypassing congested public internet transit providers.
Direct Protocol Routing: Global Accelerator routes traffic directly to endpoints (Application Load Balancers, Network Load Balancers, or EC2 instances) across one or more AWS Regions.
Zero Caching: Global Accelerator does not cache any content . It is purely a Layer 4 (TCP/UDP) and Layer 7 network transport accelerator.
Architectural Decision Matrix
- Architectural Requirement Amazon CloudFront AWS Global Accelerator
- Primary Protocol Support Layer 7 only: HTTP, HTTPS, WebSockets Layer 4 & Layer 7: TCP, UDP, HTTP, HTTPS
- Content Caching Yes (caches static and dynamic content at edge) No (pure network path optimization)
- IP Address Management Dynamic IP addresses (DNS-driven; IPs change) 2 Static Anycast IPv4 addresses (fixed)
Firewall Whitelisting Difficult (requires subscribing to AWS IP ranges) Seamless (fixed static IPs for client firewalls)
Disaster Recovery Failover DNS TTL-dependent or Origin Groups Health-check driven; AWS states an unhealthy endpoint is taken out of service in less than one minute, with no client DNS cache dependency
Client IP Address Preservation Passes client IP in X-Forwarded-For header Natively preserves client IP address to ALB/EC2