AWS-Cloudfront Summary

Cloudfront—Amazon Cloudfront is a webservice that gives business and web application develops an easy and cost effective way to distribute content with low latency and high data transfer speed.

Edge Location Servers installed at different locations –Cache memory Data stored for 24 hours.

Regional Edge location-11 (Work as an alternative to original server), cache memory data is stored for longer duration.

Benefit—Reduced latency and Original Server Had to handle less load.

Cloudfront features:

• Cloudfront is a global service
• Amazon Cloudfront is a web service that speeds up distribution of your static and dynamic web content, such as html,.CSS, .JS, and image files to your users.
• Cloudfront delivers your content through a worldwide network of data centres called Edge locations.
• When a user requests content that you are serving with Cloudfront, the user is routed (via DNS Resolution) to the Edge location that provides the lowest latency to that content is delivered with the best possible performance.
• If the content is already in the edge location with the lowest latency, Cloudfront delivers it immediately.
• This dramatically reduces the number of networks that your user’s requests must pass through which improves performance.
• If data is not in Cloudfront, Cloud front retrieves if from an Amazon S3 Bucket or an HTTP/Webserver that you have identified as the source for the definitive version of your content (Origin Server) and then keeps a copy of data in cache memory.
• Cloudfront also keeps persistent connection with origin server so files are fetched from the origin as quickly as possible.
• Can apply Geo Restriction settings based on the countries while creating cloudfront.

You can access Amazon Cloudfront in following Ways:

• 1.AWS Management Console
• 2.AWS SDKs
• 3.Cloudfront API
• 4.AWS Command Line Interface.

Cloudfront Edge locations:

• Edge locations are not tied to availability zone or regions.
• Amazon Cloudfront has 216 points of presence (205 edge locations and 11 Regional Edge locations) in 84 cities across 42 countries.

Cloudfront Regional Edge Cache:

• Ø Amazon has added several regional edge cache locations globally at close proximity to your vessels.
• Ø They are located between your origin server and the global edge locations that serve content directly to your viewers.
• Ø As objects become less popular, individual edge ocations may remove that object to make room for more popular content.
• Ø Regional Edge cache work as an alternative of origin to reduce the burden of origin.
• Ø Regional Edge cache have a large cache than any individual cache locations so object remain in the cache longer at nearest regional edge caches.

Cloudfront Regional Edge Cache Working:

• When a viewer makes a request in your websites or through your applications, DNS routes the request to the Cloudfront edge locations that can best server the user requests.
• This location is typically the nearest Cloudfront Edge location in terms of latency.
• In the Edge locations, Cloudfront checks the cache for the requested files.
• If the files are in cache, Cloudfront returns them to user.
• If the files are not in cache, the edge servers go to the nearest regional edge cache to fetch the object.
• Regional Edge caches have feature parity with edge locations, for eg a cache invalidation request removes an object from both edge cache and regional edge cache.
• The next time a viewer requests the object, Cloudfront returns to the origin to fetch the latest version of object.
• Proxy method PUT/POST/PATCH/OPTIONS/DELETE go directly to the origin from the edge locations and do not proxy through the regional edge caches.
• Dynamic content as determined at request time, does not flow through regional edge caches, but goes directly to origin.

To restrict access to content that you serve from Amazon S3 buckets, follow these steps:
– Create a special CloudFront user called an origin access identity (OAI) and associate it with your distribution.
– Configure your S3 bucket permissions so that CloudFront can use the OAI to access the files in your bucket and serve them to your users. Make sure that users can’t use a direct URL to the S3 bucket to access a file there.
Explanation
Amazon CloudFront is an easy to use, high performance, and cost efficient content delivery service. With over 50 worldwide edge locations, CloudFront is able to deliver your content to your customers with low latency in any part of the world.
In addition to serving public content for anyone on the Internet to access, you can also use Amazon CloudFront to distribute private content. For example, if your application requires a subscription, you can use Amazon CloudFront’s private content feature to ensure that only authenticated users can access your content and prevent users from accessing your content outside of your application.
Accessing private content in Amazon CloudFront is now even easier with the AWS SDK for Java. You can now easily generate authenticated links to your private content. You can distribute these links or use them in your application to enable customers to access your private content. You can also set expiration times on these links, so even if your application gives a link to a customer, they’ll only have a limited time to access the content.
To use private content with Amazon CloudFront, you’ll need an Amazon CloudFront distribution with private content enabled and a list of authorized accounts you trust to access your private content. From the Create Distribution Wizard in the Amazon CloudFront console, start creating a web distribution. In the ”’Origin Settings”’ section, select an Amazon S3 bucket that you’ve created for private content only.

Lambda@Edge is an extension of AWS Lambda, a compute service that lets you execute functions that customize the content that CloudFront delivers

Lambda@Edge scales automatically, from a few requests per day to thousands per second. Processing requests at AWS locations closer to the viewer instead of on origin servers significantly reduces latency and improves the user experience.
When you associate a CloudFront distribution with a Lambda@Edge function, CloudFront intercepts requests and responses at CloudFront edge locations.

Security at Cloudfront-With Amazon CloudFront, you can enforce secure end-to-end connections to origin servers by using HTTPS. Field-level encryption adds an additional layer of security that lets you protect specific data throughout system processing so that only certain applications can see it.”

Field-level encryption allows you to enable your users to securely upload sensitive information to your web servers. The sensitive information provided by your users is encrypted at the edge, close to the user, and remains encrypted throughout your entire application stack. This encryption ensures that only applications that need the data—and have the credentials to decrypt it—are able to do so.

Cloudfront Billing:

• Ø Amazon Cloudfront charges are based on actual usage of service in four areas:
• Ø Data transfer out (Internet/Origin)
• Ø HTTP/HTTPS request
• Ø Invalidation requests
• Ø Field level encryption requests
• Ø Dedicated IP custom SSL certificates associated with a Cloudfront distribution.
• Free Tier:
• 50GB of data transfer out-12 months free—
• 2,000, 000 http or https requests-each month for one year.