Amazon CloudFront · Content delivery network

Respond from the edge closest to users, and keep your origin hidden

CloudFront receives user requests at the edge location with the lowest latency and serves them from cache. Only requests that miss the cache travel over the AWS network to the origin, which can sit in a private subnet or a private S3 bucket.

View request path View architecture
Request pathGET /img/logo.png
  1. ViewerHTTP/3 · TLS 1.3
    REQUEST
  2. Edge location (POP)AWS WAF · CloudFront Functions
    MISS
  3. Regional edge cacheCache shared by multiple POPs
    HIT

The object missing at the POP is fetched from the regional edge cache and also stored at the POP. The request never reached the origin.

99.9%

Monthly availability SLA

50 GB

Maximum cacheable size per GET response

HTTP/3

QUIC over TLS 1.3, with connection migration

L3·L4

Shield Standard DDoS protection by default

Why CloudFront

The closer the response, the faster it is and the less your origin works

To deliver content and APIs with the same quality to users at home and abroad, finish requests close to users and reduce the number of requests that reach the origin.

Cache

Tiered caching

POPs, regional edge caches, and Origin Shield absorb requests in turn, reducing load on the origin.

Protect

Attacks stopped at the edge

Shield Standard blocks network- and transport-layer DDoS, and AWS WAF filters application-layer requests.

Program

Code that runs at the edge

CloudFront Functions and Lambda@Edge handle headers, URLs, and authentication logic in front of the origin.

Request path

How a request reaches the origin

DNS routes users to the POP with the lowest latency, and a cache miss moves on to the next tier. Proxy methods such as PUT, POST, PATCH, OPTIONS, and DELETE, and dynamic requests, bypass the regional edge cache and go directly from the POP to the origin.

01Edge

Edge location (POP)

Terminates TLS and checks the cache. AWS WAF inspection and CloudFront Functions run at this stage.

TLS terminationViewer mTLSAWS WAFCloudFront Functions
02Regional

Regional edge cache

A larger cache shared by the POPs in a geographic area. If the origin is an S3 bucket in the same Region, requests skip this tier and go directly to S3.

Shared cacheCache missGET · HEAD
03Origin

Origin Shield · Origin

With Origin Shield enabled, origin requests from all cache tiers converge on one designated Region, so requests for the same object can be collapsed into a single request to the origin.

Origin ShieldOrigin groupOACVPC originOrigin mTLSOrigin request / response

Features

Key features

S3 origin

Origin Access Control

Lets only CloudFront read your S3 bucket without making it public. It supports SSE-KMS encrypted objects and PUT and DELETE requests, and is the recommended replacement for legacy OAI.

Private origin

VPC origins

Use ALBs, NLBs, and EC2 instances in private subnets as origins. CloudFront reaches them through service-managed ENIs, so origins need no public IP. The VPC must have an internet gateway attached, and you can use VPC origins shared from other accounts through AWS RAM.

Availability

Origin failover

Group a primary and a secondary origin into an origin group. On specified status codes, connection failures, or timeouts, CloudFront retries GET, HEAD, and OPTIONS requests on the secondary.

Edge security

AWS WAF · Shield

Associate a web ACL with a distribution to inspect L7 requests. Shield Standard applies to every distribution at no extra charge, and you can upgrade to Shield Advanced.

Client identity

Viewer mTLS

Validates client X.509 certificates against a trust store at the edge, blocking untrusted clients before they reach your application. You can add validation logic with a Connection Function, check OCSP revocation, and use passthrough mode to forward certificates to the origin. There is no additional charge.

Pricing

Flat-rate pricing plans

Bundles CDN, AWS WAF and DDoS protection, bot management, Route 53 DNS, CloudWatch Logs ingestion, edge compute, and S3 storage credits into a flat monthly price per distribution. There are four tiers (Free, Pro, Business, and Premium) with no overage charges.

Edge compute

CloudFront Functions and Lambda@Edge

Put lightweight, short-running logic such as header manipulation, URL rewrites, and token validation in CloudFront Functions, and logic that needs network calls or access to the request body in Lambda@Edge.

Comparison of CloudFront Functions and Lambda@Edge
ItemCloudFront FunctionsLambda@Edge
RuntimeJavaScriptNode.js, Python
Trigger eventsViewer request, Viewer response (Connection Function for the mTLS connection stage)Viewer request·response, Origin request·response
Execution timeLess than 1 msUp to 30 seconds for both viewer and origin events
Maximum memory2 MBSame as Lambda quotas, up to 10,240 MB
Code size10 KB50 MB for both viewer and origin
Network · body accessNoYes
ScaleMillions of requests per secondUp to 10,000 requests per second per Region

Reference architecture

CloudFront as the single public entry point

Dynamic requests go through a VPC origin to an ALB in a private subnet, and static files go to S3 protected by OAC. An origin group with the ALB as primary and an S3 static page as secondary keeps responses flowing during failures.

CloudFront reference architecture When a user request arrives at an edge location, AWS WAF inspects it, and cache misses travel through the regional edge cache and Origin Shield to the origin Region. The origin group's primary is an Application Load Balancer in a private subnet connected as a VPC origin, and the secondary is an Amazon S3 bucket protected by Origin Access Control. If the primary fails, requests fail over to the secondary. Shield Standard applies across the edge. VIEWERS CLOUDFRONT SHIELD STANDARD BY DEFAULT ORIGIN REGION UsersHTTP/3 · IPv6 AWS WAFweb ACL Edge locationPOP · Functions Regional edgeShared cache Origin ShieldOpt. · 1 Region ORIGIN GROUP ALB · PrimaryVPC originPrivate subnet S3 · SecondarySigned via OACPrivate bucket Inspect Failover Specified status codes Next tier only on a cache miss
Request direction (next tier only on a cache miss) Request inspection (edge → WAF) Failover on origin failure (Primary → Secondary)

On narrow screens, swipe the diagram sideways.

Getting started

Steps to launch a distribution

  1. STEP 1

    Prepare the origin

    Set up an S3 bucket or an ALB in a private subnet. Neither needs to be public.

  2. STEP 2

    Create a distribution

    Register the origins, then attach OAC to S3 and a VPC origin to the ALB.

  3. STEP 3

    Configure cache behaviors

    For each path pattern, set the cache policy, origin request policy, and allowed methods.

  4. STEP 4

    Domain · Certificate

    Add alternate domain names and attach an ACM certificate from us-east-1.

  5. STEP 5

    Connect DNS

    Create a Route 53 alias record that points to the distribution, and verify caching behavior with response headers.

Pricing

Cost components

With pay-as-you-go pricing, data transfer out to the internet and request counts make up most of the cost. Alternatively, you can choose a flat-rate plan that bundles CDN, AWS WAF, DDoS protection, Route 53 DNS, and more into a monthly price.

CloudFront billing components
ComponentBilled byNotes
Data transfer to internetPer GB sent from the edge to users, with rates varying by geographic regionThe free tier includes 1 TB per month.
Data transfer to originPer GB of POST and PUT request bodies and WebSocket and gRPC client-to-server trafficTransfer from AWS origins such as S3 and VPC origins to CloudFront is free.
HTTP · HTTPS requestsPer 10,000 requests, with separate HTTP and HTTPS ratesThe free tier includes 10 million requests per month.
Origin ShieldPer 10,000 requests passing through Origin Shield, based on the designated RegionCharged only for requests that reach Origin Shield on a cache miss.
InvalidationPer requested path or tagThe first 1,000 paths or tags each month are free.
Edge functionsPer 1 million CloudFront Functions invocations and per 1 million KeyValueStore reads. Lambda@Edge per 1 million requests plus execution duration in GB-secondsThe Functions free tier includes 2 million invocations and 2 million KeyValueStore reads per month; Lambda@Edge has no free tier.
Additional featuresReal-time logs per 1 million lines, field-level encryption per 10,000 requests, dedicated IP custom SSL per certificate per month, Anycast static IPs per IPv4 address per hourIPv6 addresses in Anycast static IP lists are free.
Related servicesAWS WAF web ACLs, rules, and requests; Shield Advanced; Route 53Billed separately by each service. Shield Standard is free.

Rates vary by region and usage. See the CloudFront pricing page for current rates.

Next step

Design a delivery architecture that keeps your origin hidden

Bring your content types, user distribution, origin locations, and security requirements, and we will review cache policies and origin protection together.

Open service page Read the Developer Guide