Cloudfront Flashcards
What is AWS Cloudfront and what is its purpose?
It is a CDN that improves read performance by catching content at the ‘edge’
What protection does CloudFront provide?
DDoS Protection
What are the 3 different CloudFront origins?
- S3 bucket - Uploading/downloading files
- VPC - Load balancers/EC2 instances
- Custom Origin (HTTP) - Public IP’s
Compare CloudFront vs S3 Cross Region Replication
Cloudfront uses the Global Edge network where files are cached for a TLL. This is good for static content that must be available everywhere.
S3 Cross Region Replication must be setup for each region but is good for dynamic contentt htat needs to be available at low latency in a few regions.
What API can be used to invalidate part of a CloudFront cache?
CreateInvalidation API
What is a CloudFront cache key and what is its default value?
It is a unique identifier for an object in the cache and by default is the hostname + the resource portion of the URL
How can you enable a custom Cache Key and what can the cache be based on?
Using CloudFront Cache Policies you can cache based on
1. HTTP Headers
2. Cookies
3. Query Strings
When making a request to CloudFront, what will be automatically included in origin requests?
HTTP headers, cookies, and query strings
How could you specify values to include in origins requests without including them in the Cache Key?
Using Origin Request Policies (either predefined managed or custom)
When performing a cache invalidation, what are two ways you can select which files to invalidate?
- All files using *
- Specific paths ‘/’
What is the default cache behaviour and when will it be processed?
It is /* and it will always be processed last
Describe how Cache Behaviours can be used to enforce authentication?
You could connect /login to connect to a downstream ec2 instance that generates signed cookies. Then when navigating to other paths, another cache behaviour could allow/deny based on those signed cookies.
What feature can be used to delivery content from a private subnet via cloudfront?
Using a VPC origin
How can you control access to CloudFront based on to the end users country
Geographic restrictions (allow/block lists)
Suppose you want to limit access to a resource via CloudFront, what 2 things could you generate?
A signed URL - Single File
A signed Cookie - Multiple Files
Compare CloudFront signed URLs to S3 presigned URLs. When should you use each?
CloudFront Signed URL
- Allow access to a path, no matter the origin
- Good for when you want to use caching features
S3 Presigned URL
- Allows for issuing a request as the person who presigned the url
- Limited lifetime
What are the two signers for CloudFront signed URLs? Why is one recommended over the other?
- Trusted Key Group - Preffered as IAM can be used and API can create/rotate keys
- Account with CloudFront Key Pair - Not recommended as requires root account
How many price classes are there for CloudFront?
There are 3 [All, 200, 100]
How could you improve your service availablity with CloudFront?
Use two origin groups, with one failing over to the other incase any issue occurs
When using Field Level Encryption, where is the data encrypted and decrypted?
Encrypted using Public Key on Edge Location
Decrypted using Private Key on Web Server
