# CloudFront

* CloudFront is a web service that **speeds up distribution of your static and dynamic web content**, such as .html, .css, .js, and image files, to your users.\\

* It delivers your content through a **worldwide network of data centres called edge locations**.\\

* **When a user requests content that you're serving with CloudFront, the request is routed to the edge location that provides the lowest latency (time delay)**, so that content is delivered with the best possible performance.\\

  * **If the content is already in the edge location with the lowest latency, CloudFront delivers it immediately**.\\

  * **If the content is not in that edge location, CloudFront retrieves it from an origin that you've defined, e.g. such as an S3 bucket,** that you have identified as the source for the definitive version of your content.

## Origin Access Identity (OAI)

* To **ensure that your users access your files using only CloudFront URLs**, regardless of whether the URLs are signed, do the following:

  1. **Create a special CloudFront user called an OAI and associate it** with your distribution.
  2. **Configure your S3 bucket permissions** so that CloudFront can use the **OAI to access the files in your bucket** and serve them to your users.

* After you take these steps, **users can only access your files through CloudFront, not directly from the S3 bucket**.

## Using SNI to Serve HTTPS Requests

* **Server Name Indication (SNI) is an extension for the TLS protocol**, which is used in HTTPS.\\

* It's included in the TLS/SSL handshake process in order to ensure that **client devices are able to see the correct SSL certificate for the website they are trying to reach**.

## Signed URLs

* Many companies that distribute content over the internet want to **restrict access to documents, business data, media streams, or content that is intended for selected users**, for example, users who have paid a fee.\\

* **Require that your users access your private content by using special CloudFront signed URLs or signed cookies**.

* Use **signed URLs in the following cases:**

  * You want to **restrict access to individual files**, for example, an installation download for your application.
  * Your **users are using a client (for example, a custom HTTP client) that doesn't support cookies**.

* Use **signed cookies in the following cases:**
  * You want to **provide access to multiple restricted files**, for example, all of the files for a video in HLS format or all of the files in the subscribers' area of website.
  * You **don't want to change your current URLs**.
