CloudFront

• CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users.

• It delivers your content through a worldwide network of data centres called edge locations.

• When a user requests content that you're serving with CloudFront, the request is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance.

  • If the content is already in the edge location with the lowest latency, CloudFront delivers it immediately.

  • If the content is not in that edge location, CloudFront retrieves it from an origin that you've defined, e.g. such as an S3 bucket, that you have identified as the source for the definitive version of your content.

Origin Access Identity (OAI)

• To ensure that your users access your files using only CloudFront URLs, regardless of whether the URLs are signed, do the following:

  1. Create a special CloudFront user called an OAI and associate it with your distribution.

  2. Configure your S3 bucket permissions so that CloudFront can use the OAI to access the files in your bucket and serve them to your users.

• After you take these steps, users can only access your files through CloudFront, not directly from the S3 bucket.

Using SNI to Serve HTTPS Requests

• Server Name Indication (SNI) is an extension for the TLS protocol, which is used in HTTPS.

• It's included in the TLS/SSL handshake process in order to ensure that client devices are able to see the correct SSL certificate for the website they are trying to reach.

Signed URLs

• Many companies that distribute content over the internet want to restrict access to documents, business data, media streams, or content that is intended for selected users, for example, users who have paid a fee.

• Require that your users access your private content by using special CloudFront signed URLs or signed cookies.

• Use signed URLs in the following cases:

  • You want to restrict access to individual files, for example, an installation download for your application.

  • Your users are using a client (for example, a custom HTTP client) that doesn't support cookies.

• Use signed cookies in the following cases:

  • You want to provide access to multiple restricted files, for example, all of the files for a video in HLS format or all of the files in the subscribers' area of website.

  • You don't want to change your current URLs.