3.7 CloudFront Labs

Go head click Create Distribution, and start to create web distribution. Just follow the info icon to configure your distribution.

Origin

• You can have multiple Origins to be distributed, they should be distinguished by their Origin ID. Here we take S3 Bucket as an example of the Origin.

• Origin Path can be a S3 bucket as well as an individual folder in a bucket.

• Enable Restrict Bucket Access: your objects in your S3 bucket will be no longer public, so clients must access your objects through CloudFront (Edge Locations). Then you need to create an Original Access Identity (OAI), you can just create a new identity.

• Enable Grant Read Permissions on Bucket: this will grant read permissions to all the objects in the Origin bucket (so it will change your previous permissions configurations).

Default Cache Behavior Settings

• Path Pattern: can be seen as a regular expression.

• Viewer Protocol Policy: using HTTPS means clients will be allowed to access your CloudFront distribution using SSL (Security Socket Layer).

• Allowed HTTP Methods: if you allow clients to PUT or POST something, the file will be stored in Edge Locations firstly, then Edge Location will update your Origin.

• Default TTL (seconds): this is the TTL for the objects within this CloudFront distribution. Within this TTL, the objects will be cached in Edge Location. This value depends on your update frequency. If you often update your content, TTL should be shorter.

• Restrict Viewer Access: if you enable this, viewers must use CloudFront signed URLs or signed cookies to access your content.

Distribution Settings

• Alternate Domain Names (CNAMEs): you can set a friendly URL for your distribution. This will be introduced deeper in Route53.

• You can enable Logging, and the log will be stored in a S3 bucket.

After you created your distribution

• You can go to Restrictions tab and configure Geo-Restriction, which can tell CloudFront which countries you want (or don't want) to distribute your content to.

• You can using an Origin Access Identity (OAI) which is a special CloudFront user to restrict access to your Amazon S3 Content Origin.

  • If you want to use CloudFront signed URLs or signed cookies to provide access to objects in your Amazon S3 bucket, you probably also want to prevent users from accessing your Amazon S3 objects using Amazon S3 URLs. If users access your objects directly in Amazon S3, they bypass the controls provided by CloudFront signed URLs or signed cookies.

  • Steps: #1. You can create an OAI and associate it with your distribution or create an OAI during creating your distribution. #2. Give the OAI permission to read the objects in your bucket. #3. You need to change the permissions either on your Amazon S3 bucket or on the objects in your bucket so only the origin access identity has read permission (or read and download permission). When your users access your Amazon S3 objects through CloudFront, the CloudFront origin access identity gets the objects on behalf of your users. If your users request objects directly by using Amazon S3 URLs, they're denied access.

• You can using Custom Headers to Restrict Access to Your Content on a Custom Origin.

• You can remove objects from Edge Location through Invalidations tab, but you will pay for removing.

• If you want to delete your distribution, you need to disable it firstly, then you can delete it.

• You can apply URL RewriteRule on Origin, so that you can redirect the requests to the Origin (e.g. a S3 bucket) to the CloudFront distribution.