ExamFinch.com My Study

Study guide

3.6 CloudFront, Route 53, and Global Accelerator

Practice this exam

AWS Solutions Architect Associate SAA-C03

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the AWS Solutions Architect Associate (SAA-C03) Exam Study Strategies and Exam Tips for SAA-C03 The AWS Well-Architected Framework

2 Domain 1: Design Secure Architectures (30%)

1.1 IAM Fundamentals — Users, Groups, Roles, and Policies 1.2 AWS Organizations, SCPs, and Multi-Account Strategy 1.3 VPC Security — Security Groups, NACLs, and VPC Endpoints 1.4 Encryption, KMS, and Secrets Management 1.5 AWS WAF, Shield, and Network Firewall 1.6 GuardDuty, Inspector, Macie, and Security Hub 1.7 The Shared Responsibility Model for Solutions Architects 1.8 Data Protection, Compliance, and Audit Services

3 Domain 2: Design Resilient Architectures (26%)

2.1 Elastic Load Balancing (ELB) — ALB, NLB, and GWLB 2.2 EC2 Auto Scaling — Dynamic, Predictive, and Scheduled 2.3 Multi-AZ and Multi-Region Architectures 2.4 Disaster Recovery Strategies — RTO and RPO 2.5 Decoupling with SQS, SNS, and EventBridge 2.6 AWS Step Functions and Workflow Orchestration

4 Domain 3: Design High-Performing Architectures (24%)

3.1 EC2 Instance Types, Purchasing Options, and Placement Groups 3.2 Lambda, Serverless Compute, and Container Services 3.3 Amazon S3 - Storage Classes, Lifecycle, and Performance 3.4 Block and File Storage - EBS, EFS, and FSx 3.5 Database Services - RDS, Aurora, DynamoDB, and More 3.6 CloudFront, Route 53, and Global Accelerator 3.7 Data Ingestion and Transformation - Kinesis, Glue, and EMR

5 Domain 4: Design Cost-Optimized Architectures (20%)

4.1 Compute Cost Optimization — Right-Sizing, RIs, Savings Plans, and Spot 4.2 Storage Cost Optimization — S3 Tiers, EBS, and Data Transfer 4.3 Database Cost Optimization 4.4 AWS Cost Management and Monitoring Tools

6 VPC and Networking Deep Dive

5.1 VPC Architecture — Subnets, Route Tables, and Gateways 5.2 VPC Connectivity — Peering, Transit Gateway, and Direct Connect 5.3 Amazon API Gateway 5.4 CloudFormation and Infrastructure as Code 5.5 AWS PrivateLink and Endpoint Services

7 Migration, Transfer, and Hybrid Services

6.1 The 7 Rs of Cloud Migration 6.2 AWS Snow Family — Snowball Edge Devices 6.3 CloudWatch, CloudTrail, and AWS Config 6.4 Amazon Cognito and Identity Federation 6.5 AWS DataSync and Transfer Family

8 Serverless Architecture and Application Services

7.1 Serverless Architecture Patterns 7.2 Advanced SQS Patterns — DLQ, Backpressure, and FIFO 7.3 Analytics Services — Athena, OpenSearch, and QuickSight 7.4 Container Orchestration — ECS, EKS, and ECR

9 Advanced Topics and Exam Scenarios

8.1 Advanced IAM — Permission Boundaries, Federation, and Cross-Account 8.2 Caching Strategies and ElastiCache Patterns 8.3 Hybrid Architecture — DNS, Storage, and Compute 8.4 SAA-C03 Scenario Practice — Putting It All Together

3.6 CloudFront, Route 53, and Global Accelerator

Key Takeaways Explain This Topic AI

CloudFront is a CDN with 750+ points of presence (POPs) that caches HTTP/HTTPS content close to users and integrates with S3, ALB, EC2, API Gateway, and Lambda@Edge.

Route 53 provides DNS, registration, and health checks with routing policies: simple, weighted, latency, failover, geolocation, geoproximity, and multivalue answer.

Global Accelerator routes TCP/UDP traffic over the AWS backbone with two static anycast IPs and near-instant BGP failover - it does not cache content.

CloudFront Origin Access Control (OAC) locks an S3 origin so it is reachable only through CloudFront, not directly.

Decision rule: cacheable web/API content -> CloudFront; non-cacheable TCP/UDP or static-IP needs -> Global Accelerator; DNS routing and failover logic -> Route 53.

Last updated: October 2026

Quick Answer: CloudFront = CDN caching HTTP/HTTPS at 750+ points of presence (POPs). Route 53 = DNS with health checks and routing policies. Global Accelerator = AWS backbone routing for TCP/UDP with two static anycast IPs and instant failover. Use CloudFront for websites/APIs, Global Accelerator for gaming/VoIP/static-IP needs, and Route 53 to steer DNS.

Amazon CloudFront

CloudFront is AWS's content delivery network (CDN) caching at 750+ points of presence (POPs) worldwide to cut latency and offload origins. Supported origins include S3, ALB, EC2, API Gateway, MediaStore, and any custom HTTP server (on-prem or other cloud).

  • Feature Description
  • Edge caching Serve cached objects from the nearest edge
  • Free HTTPS TLS via ACM, HTTP-to-HTTPS redirect
  • Geo-restriction Allow/block by country
  • Price classes All, 200, or 100 to trade reach for cost
  • Lambda@Edge Run Lambda at edge for request/response logic
  • CloudFront Functions Lightweight JS for header/URL rewrites
  • Field-level encryption Encrypt sensitive POST fields at the edge
  • Origin Access Control (OAC)

OAC ensures an S3 origin is reachable only through CloudFront: create the distribution with OAC, then set the bucket policy to allow only that distribution. Users cannot bypass CloudFront to hit S3 directly. OAC replaces the legacy Origin Access Identity (OAI) and is the current best-practice answer.

Cache Behavior

The cache key (URL plus selected headers, query strings, and cookies) determines uniqueness; tune it with cache policies and origin request policies . TTL controls freshness, and invalidations force-evict objects but cost per path - prefer versioned object names over frequent invalidations.

Amazon Route 53

Route 53 is AWS's authoritative DNS with domain registration and health checking.

  • Policy Behavior Typical use
  • Simple One record, no health checks Basic mapping
  • Weighted Split traffic by percentage Canary / blue-green
  • Latency-based Lowest-latency Region for the user Multi-Region apps
  • Failover Active-passive with health checks Disaster recovery
  • Geolocation Route by user's country/continent Localization, compliance
  • Geoproximity Route by distance with bias shifting Gradually shift Region traffic
  • Multivalue answer Up to 8 healthy records Simple client-side LB

Health checks come in three kinds: endpoint (HTTP/HTTPS/TCP), calculated (AND/OR of other checks), and CloudWatch-alarm-based. Latency-based and geolocation are easy to confuse: latency picks the fastest Region, geolocation picks by where the user is , which is not always the fastest.

AWS Global Accelerator

Global Accelerator routes user traffic onto the AWS global backbone at the nearest edge, then forwards over AWS's private network to the optimal healthy endpoint.

  • Feature CloudFront Global Accelerator
  • Layer CDN (caches content) Network (no caching)
  • Protocols HTTP/HTTPS TCP and UDP
  • IP addresses DNS name by default; optional Anycast static IP list Two static anycast IPs
  • Failover Origin failover per request (origin groups) BGP-based, near-instant
  • Best for Cacheable web content Gaming, IoT, VoIP, static IP allow-listing

Reach for Global Accelerator when an answer mentions non-cacheable real-time traffic, UDP , the need for static IPs (e.g. firewall allow-listing), or instant regional failover that DNS TTLs cannot provide.

On the Exam: "Cache and serve a static S3 site globally while blocking direct bucket access" -> CloudFront + OAC. "Real-time UDP multiplayer game needing static IPs" -> Global Accelerator. "Send users to the lowest-latency Region" -> Route 53 latency-based routing.

Worked Scenario: Building a Global Front Door

Consider a global media site whose static assets live in S3 and whose dynamic API runs behind an ALB in two Regions. The right design layers all three services. Put CloudFront in front of the S3 assets to cache them at the edge, and lock the bucket with OAC so users cannot bypass the CDN. Use Route 53 latency-based routing to send each user to the nearest healthy Regional API endpoint, with a failover record pair so a Region outage automatically reroutes traffic.

If a separate, non-HTTP service - say a UDP telemetry ingest endpoint - needs static IPs and instant failover, front that one with Global Accelerator rather than CloudFront, because Global Accelerator carries TCP/UDP over the AWS backbone and provides two static anycast IPs.

Common Traps to Avoid

CloudFront vs Global Accelerator. CloudFront caches HTTP/HTTPS content; Global Accelerator does not cache and handles arbitrary TCP/UDP with static IPs. "Cacheable web content" -> CloudFront; "non-cacheable, static IP, UDP" -> Global Accelerator.

Latency vs geolocation routing. Latency-based routing picks the fastest Region; geolocation routes by the user's country/continent and may not be fastest. Choose by the literal requirement - speed vs location/compliance.

OAI vs OAC. OAI is the legacy mechanism; current best practice for restricting an S3 origin to CloudFront is Origin Access Control (OAC).

Expecting fast DNS failover. DNS-based failover is gated by record TTLs and resolver caching; when the requirement is near-instant failover, Global Accelerator's BGP-based path is the better answer.

Frequent invalidations. Invalidating CloudFront objects costs per path; for cache-busting, prefer versioned object names over constant invalidations.