CloudFront & AWS Global Accelerator
AWS CloudFront
β’ Content Delivery Network (CDN)
β’ Improves read performance, content is cached at the edge
β’ 216 Point of Presence globally (edge locations)
β’ DDoS protection, integration with Shield, AWS Web Application Firewall
β’ Can expose external HTTPS and can talk to internal HTTPS backends
Source: https://aws.amazon.com/cloudfront/features/?nc=sn&loc=2
CloudFront β Origins
β’ S3 bucket
β’ For distributing files and caching them at the edge
β’ Enhanced security with CloudFront Origin Access Identity (OAI)
β’ CloudFront can be used as an ingress (to upload files to S3)
β’ Custom Origin (HTTP)
β’ Application Load Balancer
β’ EC2 instance
β’ S3 website (must first enable the bucket as a static S3 website)
β’ Any HTTP backend you want
CloudFront Geo Restriction
β’ You can restrict who can access your distribution
β’ Whitelist: Allow your users to access your content only if they're in one of the countries on a list of approved countries.
β’ Blacklist: Prevent your users from accessing your content if they're in one of the countries on a blacklist of banned countries.
β’ The βcountryβ is determined using a 3rd party Geo-IP database
β’ Use case: Copyright Laws to control access to content
CloudFront vs S3 Cross Region Replication
β’ CloudFront:
β’ Global Edge network
β’ Files are cached for a TTL (maybe a day)
β’ Great for static content that must be available everywhere
β’ S3 Cross Region Replication:
β’ Must be setup for each region you want replication to happen
β’ Files are updated in near real-time
β’ Read only
β’ Great for dynamic content that needs to be available at low-latency in few region
CloudFront Signed URL / Signed Cookies
β’ You want to distribute paid shared content to premium users over the world
β’ We can use CloudFront Signed URL / Cookie. We attach a policy with:
β’ Includes URL expiration
β’ Includes IP ranges to access the data from
β’ Trusted signers (which AWS accounts can create signed URLs)
β’ How long should the URL be valid for?
β’ Shared content (movie, music): make it short (a few minutes)
β’ Private content (private to the user): you can make it last for years
β’ Signed URL = access to individual files (one signed URL per file)
β’ Signed Cookies = access to multiple files (one signed cookie for many files)
CloudFront Signed URL vs S3 Pre-Signed URL
β’ CloudFront Signed URL:
β’ Allow access to a path, no matter the origin
β’ Account wide key-pair, only the root can manage it
β’ Can filter by IP, path, date, expiration
β’ Can leverage caching features
β’ S3 Pre-Signed URL:
β’ Issue a request as the person who pre-signed the URL
β’ Uses the IAM key of the signing IAM principal
β’ Limited lifetime
CloudFront β Price Classes
β’ You can reduce the number of edge locations for cost reduction \
β’ Three price classes:
Price Class All: all regions β best performance
Price Class 200: most regions, but excludes the most expensive regions
Price Class 100: only the least expensive regions\
CloudFront β Multiple Origin
CloudFront β Origin Groups
β’ To increase high-availability and do failover
β’ Origin Group: one primary and one secondary origin
β’ If the primary origin fails, the second one is used
CloudFront β Field Level Encryption
β’ Protect user sensitive information through application stack
β’ Adds an additional layer of security along with HTTPS
β’ Sensitive information encrypted at the edge close to user
β’ Uses asymmetric encryption
β’ Usage:
β’ Specify set of fields in POST requests that you want to be encrypted (up to 10 fields)
β’ Specify the public key to encrypt them
Global users for our application
β’ You have deployed an application and have global users who want to access it directly.
β’ They go over the public internet, which can add a lot of latency due to many hops
β’ We wish to go as fast as possible through AWS network to minimize latency
AWS Global Accelerator
β’ Leverage the AWS internal network to route to your application
β’ 2 Anycast IP are created for your application
β’ The Anycast IP send traffic directly to Edge Locations
β’ The Edge locations send the traffic to your application
AWS Global Accelerator
β’ Works with Elastic IP, EC2 instances, ALB, NLB, public or private
β’ Consistent Performance
β’ Intelligent routing to lowest latency and fast regional failover
β’ No issue with client cache (because the IP doesnβt change)
β’ Internal AWS network
β’ Health Checks
β’ Global Accelerator performs a health check of your applications
β’ Helps make your application global (failover less than 1 minute for unhealthy)
β’ Great for disaster recovery (thanks to the health checks)
β’ Security
β’ only 2 external IP need to be whitelisted
β’ DDoS protection thanks to AWS Shield
AWS Global Accelerator vs CloudFront
β’ They both use the AWS global network and its edge locations around the world
β’ Both services integrate with AWS Shield for DDoS protection.
β’ CloudFront
β’ Improves performance for both cacheable content (such as images and videos)
β’ Dynamic content (such as API acceleration and dynamic site delivery)
β’ Content is served at the edge
β’ Global Accelerator
β’ Improves performance for a wide range of applications over TCP or UDP
β’ Proxying packets at the edge to applications running in one or more AWS Regions.
β’ Good fit for non-HTTP use cases, such as gaming (UDP), IoT (MQTT), or Voice over IP
β’ Good for HTTP use cases that require static IP addresses
β’ Good for HTTP use cases that required deterministic, fast regional failover
Last updated