CloudFront

Serving every user request from a single origin region means users far from that region get slow load times, and the origin bears the full traffic load. Amazon CloudFront solves this: a global Content Delivery Network (CDN) that caches your content (static assets, and even dynamic content with the right cache rules) at hundreds of edge locations worldwide, serving users from the location closest to them.

• CloudFront is a global service — a single distribution is deployed to edge locations across the entire CloudFront network, not tied to one region.
• The origin (S3 bucket, ALB, EC2, or any custom HTTP endpoint) still lives in a specific region — CloudFront just fronts it globally.
• Edge locations (200+) are separate from Regional Edge Caches, a mid-tier caching layer between edge locations and the origin that reduces origin load for less-popular content.

graph LR
User1(("User: Asia")) --> Edge1["Edge Location"]
User2(("User: Europe")) --> Edge2["Edge Location"]
Edge1 -.->|"cache miss"| Origin["Origin: S3 / ALB"]
Edge2 -.->|"cache miss"| Origin

CloudFront bills based on data transfer out to users (priced per edge-location region) and number of HTTP/HTTPS requests — no charge for the distribution itself. Data transfer from an AWS origin (S3, ALB) to CloudFront is free, which is one reason CloudFront in front of S3 is often cheaper than serving S3 directly.

• Origin Access Control (OAC) (successor to OAI) restricts an S3 origin bucket so it’s only reachable through CloudFront, not directly — a very common secure-static-website exam pattern.
• CloudFront supports field-level encryption, signed URLs/cookies for private content, and integrates with AWS WAF for edge-level request filtering.
• Cache behavior is controlled by TTL settings and cache keys (headers, query strings, cookies) — the exam often tests “why isn’t my content updating,” which is almost always a caching/invalidation issue.
• CloudFront can front any HTTP origin, not just AWS ones — including on-premises servers — making it useful for hybrid and multi-cloud content delivery too.