Master Amazon CloudFront: Complete CDN & HTTP Caching Course

Learn how CDNs like CloudFront create a win-win-win by caching content closer to users, dramatically improving performance while reducing server load. Discover the core mechanics of how browsers, CDNs, and origin servers work together to deliver lightning-fast experiences.

Master the art of cache lifetimes and discover why your website's logo, product images, and shopping cart each need drastically different TTL strategies. Learn which HTTP operations can be cached for maximum performance and which ones should never touch your CDN.

Understand the crucial difference between private browser caches and shared CDN caches, and why your users' browsers are actually your fastest cache layer. Explore the trade-offs between lightning-fast local caching and your ability to control when content updates across your user base.

Master the Cache-Control header through real-world examples from Wikipedia, Google, and Reddit, learning essential directives like max-age, s-maxage, and immutable. Discover how to read response headers with curl and understand why different resources have vastly different caching strategies.

Learn how cache revalidation lets you verify if stale content is still valid without retransmitting data, using ETags and If-Modified-Since headers to save bandwidth. Discover advanced directives like stale-while-revalidate and stale-if-error that let you serve cached content strategically while updating in the background.

Learn cache busting techniques that let you use long TTLs for fast performance while still deploying updates instantly by strategically modifying URLs with version IDs or file hashes. Understand when cache busting works perfectly for embedded resources and when you're forced to choose between caching benefits and update speed for stable URLs.

Recap the complete HTTP caching flow from browser private cache through CDN shared cache to origin server, understanding how layered caching reduces network round-trips and bandwidth. See real-world caching in action by inspecting Mozilla's developer site with browser dev tools to observe revalidation and cache decisions live.

Discover how CloudFront's 700+ edge locations and tiered caching architecture work together to deliver your content globally, and follow along as we create your first distribution with a live demo. Learn the key differences between control plane and data plane operations, explore CloudFront's three price classes, and see real cache behavior in action using curl commands.

Dive into the Infrastructure as Code behind our CloudFront distribution and discover how just a few Terraform resources connect CloudFront to S3 securely using Origin Access Control. Walk through the actual code on GitHub as we break down each component—from bucket policies to distribution configuration—and set the foundation for understanding CloudFront's request flow in the next video.

Follow a single HTTP request's journey through CloudFront's edge locations and uncover how behaviors, cache policies, origin request policies, and response headers policies work together to determine what gets cached and returned. See a live demonstration that finally solves the mystery of why CloudFront cached our content without a Cache-Control header, and learn how TTL defaults actually work in practice.

Master CloudFront behaviors—the traffic routing rules that map URL patterns to origins and policies—and learn strategic approaches for determining how many behaviors your application actually needs. Explore the complete configuration options available in each behavior, from HTTP method restrictions to Lambda@Edge integration, with practical guidance on when to add new behaviors versus keeping your distribution simple.

Unpack CloudFront's cache policy—the configuration that controls TTL boundaries, builds your cache key from headers/cookies/query parameters, and enables compression—with real-world examples showing how to balance cache-hit ratios against application functionality. Learn critical security considerations around minimum TTL settings and see practical scenarios for when to include Accept-Language, cookies for A/B testing, or query parameters in your cache key.

Understand how CloudFront's origin request policy controls what data gets forwarded during cache misses and revalidations, and learn the crucial interaction between origin request policies and cache policies that automatically forwards cache key components. Explore filtering options for headers, query strings, and cookies—plus discover when CloudFront's special headers can provide valuable statistics for your origin servers.

Learn how CloudFront's response headers policy lets you add security headers (HSTS, CSP, X-Frame-Options), customize CORS settings, and inject or remove custom headers before every client response—plus discover how server timing headers unlock deeper performance insights. See practical examples like adding Cache-Control headers to S3 responses and understand which security headers you should enable (and which legacy ones like X-XSS-Protection to avoid).

Watch a live multi-origin CloudFront deployment in action with a calculator app that demonstrates dynamic Lambda-based responses, static S3 content, and three different caching strategies working together. See real cache behavior with query parameters, explore the complete architecture from distribution to origins, and discover how behaviors route traffic between static assets and serverless compute based on URL patterns.

Explore CloudFront origins in depth—from domain configuration and path prefixes to timeout settings and connection retry logic—and understand how origins receive traffic after origin request policies are applied. Learn practical configuration options like custom headers for API authentication, connection keep-alive strategies, and see how CloudFront handles errors when timeouts are breached or connection attempts are exhausted.

Discover how Origin Shield consolidates all CloudFront traffic through a single regional edge cache to maximize cache-hit ratios and reduce origin load, especially valuable for streaming and read-heavy workloads where origin fetches are expensive. Learn the trade-offs between improved performance and potential availability risks, plus get practical guidance on selecting the optimal Origin Shield region based on your origin's location.

Learn how CloudFront Origin Groups provide automatic failover between primary and secondary origins based on HTTP error codes, but understand the critical limitation that each request independently attempts the primary origin first—potentially causing elevated response times during outages. Discover when this feature makes sense for static content scenarios versus when other high availability strategies might be more efficient for your application.

See CloudFront cache invalidations in action as we forcefully clear cached resources from all edge locations using path patterns, and understand why invalidations ignore cache key components like headers and cookies (only query parameters matter). Learn the free tier limits, cost structure, and most importantly—why you should architect for cache busting instead of relying on invalidations except for emergency content removal scenarios.

Transform CloudFront's default error pages into branded custom experiences by configuring error response mappings for 4XX and 5XX status codes, complete with TTL caching controls and optional status code overrides for security purposes. See a live implementation with custom-designed error pages for a calculator app, and learn critical considerations around response headers policies, debugging trade-offs, and why you should wait until your distribution is fully configured before adding custom error responses.

CloudFront comes with its own basic Report and Statistics module. In this session, we'll explore it a bit.

Recap the complete CloudFront request flow from both logical (behavior→cache policy→origin request policy→response headers policy) and physical perspectives (edge locations→regional edge caches→origin shield→origins), synthesizing over 2 hours of content into a clear mental model. Consolidate your understanding of how policies interact, how the tiered caching architecture physically routes requests, and how features like origin groups and origin shield fit into the larger picture before moving into AWS service integrations.

Discover how to give your CloudFront distribution a professional custom domain and bulletproof HTTPS encryption—we'll cut through the DNS complexity and show you the exact Route53 and ACM setup that makes it work seamlessly. You'll see the full TLS handshake in action and understand why that certificate must live in us-east-1.

Master CloudFront's four logging layers—from CloudTrail audit trails to real-time Kinesis streams—and learn which one to use when (hint: Standard Logging v2 just changed the game with Firehose integration). We'll wire up live demos sending logs to S3, CloudWatch, and Firehose so you can see exactly how requests flow through your observability stack.

Unlock CloudFront's 14 CloudWatch metrics (6 free, 8 paid but worth it) and build a live monitoring dashboard that catches performance issues before your users do—we'll trigger real alarms by simulating random 500 errors and latency spikes. Watch as we set thresholds on cache hit rate and origin latency, then stress-test the system to see CloudWatch alarms fire in real-time.

Deploy AWS WAF at the edge to block malicious traffic before it even gets close to your origin—we'll set up rate limiting and then hammer the distribution until WAF cuts us off with a 403. You'll see exactly how CloudFront evaluates firewall rules at edge locations in us-east-1 and watch the security metrics update in real-time as we trigger the protection.

Learn why KMS-encrypted S3 origins require a two-step permission dance—granting both S3 and KMS access to your CloudFront distribution—and discover the Etag gotcha that breaks cache revalidation (plus the bucket key trick that slashes your KMS costs). We'll show you exactly how to wire up the origin access control and key policy so CloudFront can decrypt your objects without exposing them publicly.

Ditch the legacy secret-header hack and discover VPC Origins—the modern way to connect CloudFront directly to private ALBs, NLBs, and EC2 instances without exposing them to the internet. We'll compare the old school approach (managing custom headers and public subnets) versus the elegant new solution that references your private resources by ARN and eliminates the attack surface.

Integrate edge-optimized API Gateway with CloudFront using the origin path trick to hide stage names from your users—we'll show you why this deployment type can't be changed later and how to lock down direct API access with custom headers. You'll see the exact domain name parsing that maps CloudFront paths to API Gateway stages and learn when (and why) you'd want to add that extra security layer.

Connect CloudFront to any HTTP/HTTPS endpoint on the internet as a custom origin-we'll use httpbin.org to peek inside the actual requests CloudFront sends and see exactly what headers get added. This is your go-to setup for non-AWS origins, and we'll show you the same secret-header authentication pattern to lock it down in production.

We've covered the essential CloudFront integrations—custom domains, logging layers, monitoring dashboards, WAF protection, KMS-encrypted S3, VPC origins, API Gateway, and custom endpoints—now it's time to level up. Next module unlocks the real power: manipulating requests and responses as they flow through the edge, giving you programmatic control over your CDN behavior.

Discover how to take control of CloudFront's request-response flow by injecting custom logic at four critical points—before cache lookups, during origin requests, and on both viewer and origin responses. Learn the strategic differences between CloudFront Functions and Lambda@Edge so you can choose the right tool to dynamically modify headers, rewrite URLs, or even generate responses without touching your origin.

Confused about when to use CloudFront Functions versus Lambda@Edge for your request modifications? This video breaks down the critical trade-offs—execution location, performance limits, code constraints, and costs—so you can confidently pick the right tool for your specific use case.

See CloudFront Functions in action with a real blue/green deployment system that routes traffic between application versions using a key-value store—all with zero downtime. Walk through live code, explore the eventually consistent architecture, and learn the critical runtime limitations you need to know before deploying to production.

Understand why Lambda@Edge exists despite its long list of limitations—from cold start latency to scattered logs across 13 regions—and learn how its architecture fundamentally differs from both regular Lambda functions and CloudFront Functions. This session strips away the marketing to show you the real operational challenges and trade-offs you'll face when running code at regional edge caches instead of individual edge locations.

Despite all its constraints, Lambda@Edge unlocks capabilities CloudFront Functions simply can't handle—full Python and NodeJS runtimes, IAM-based access to AWS services, and enough compute power for complex operations. See how to combine both technologies in a single distribution to leverage the strengths of each, complete with a practical blue/green deployment that calls external services and manages state across regional edge caches.

You've now seen both CloudFront Functions and Lambda@Edge in action with real deployment scenarios, but the decision of which to use isn't always obvious. This summary distills the strategic framework for choosing between them—when to prioritize the sub-millisecond latency of edge-location execution versus the flexibility of full AWS service integration—and reminds you that the documentation contains critical gotchas beyond what we've covered here.

Looking to protect your CloudFront content from unauthorized access? This lesson reveals how CloudFront's authentication works under the hood, from signed URLs and cookies to the cryptographic principles that make them secure, setting you up to choose the right solution for your use case.

Ready to implement bulletproof authentication for your CloudFront distributions? This hands-on lesson walks you through creating signed URLs and cookies with a live demo app, showing you exactly how to cryptographically protect your premium content while keeping it cacheable at the edge.

Need more flexibility than signed URLs and cookies can offer? This lesson shows you how to build custom authentication solutions using CloudFront Functions and Lambda@Edge, from API keys and HTTP Basic Auth to JWT validation and beyond.