AWS CloudFront Setup Guide: Distributions & Caching

Why Choose CloudFront

CloudFront is the official AWS global CDN service, deeply integrated with S3, EC2, ALB, and other AWS products. It is ideal for websites, SaaS products, and video applications already running on AWS. Content is cached at edge locations around the world, which sharply reduces cross-region latency, and it can be combined with AWS WAF and Shield for security. If you have not decided on a provider yet, start with our CDN provider comparison.

Step 1: Prepare Your Origin

Before creating a distribution, prepare the origin where your content is stored:

  • S3 bucket: best for static assets. Bucket names must be lowercase with no spaces. Use Origin Access Control (OAC) so the bucket can only be reached through CloudFront.
  • HTTP server: for example EC2 or a self-hosted server. CloudFront forwards requests to this server, so make sure it permits CloudFront access and is properly hardened.

Origins outside AWS work too; CloudFront offers configurable origin protocol, port, and host header settings.

Step 2: Create a Distribution

In the CloudFront console, go to Distributions → Create distribution:

  1. Enter a Distribution name; you can attach up to 50 tags for management.
  2. Choose the Origin type (S3, custom, and so on), enter the origin domain, and optionally add an Origin path such as /static so the CDN only fetches that directory.
  3. Choose Origin settings: use the recommended defaults, or customize cache and origin parameters.
  4. On the Enable security protections page, optionally attach an AWS WAF web ACL.

After creation the console returns a domain such as d111111abcdef8.cloudfront.net. Wait until the status changes from Deploying to Enabled, then test it.

Step 3: Configure Cache Behaviors

Each distribution has a default cache behavior, and you can set different caching rules per path:

  • Path pattern: for example /images/* or /*.css, each with its own policy.
  • Cache policy and TTL: static assets (images, CSS, JS) can be cached for 30+ days; dynamic APIs should use TTL 0 or a dynamic acceleration plan. See our CDN cache strategy.
  • Query strings: keeping parameters such as ?id=1 affects hit ratio; keep them only when needed.

CloudFront ships managed cache policies you can select per scenario: CachingOptimized sets long TTLs for static assets and ignores query strings (great for images, CSS, JS); CachingDisabled never caches (dynamic APIs); Elemental-MediaPackage targets streaming. When customizing, watch two fields — the TTL minimum/default/maximum (how long objects stay at the edge) and the cache key (which dimensions distinguish cache objects: typically host, path, query strings, and headers). Getting those two right is most of the battle for hit ratio — see cache key strategy for more.

Step 4: Attach an HTTPS Certificate

CloudFront serves HTTPS on *.cloudfront.net by default. To use your own domain:

  1. Request a certificate in AWS Certificate Manager (ACM) — it must be created in the us-east-1 (N. Virginia) region.
  2. Add the Alternate Domain Name (CNAME), for example cdn.example.com.
  3. Point cdn.example.com to d111111abcdef8.cloudfront.net with a CNAME record.

For help choosing a certificate type, see SSL certificate guide 2026.

Step 5: Invalidate the Cache

After updating content on the origin, clear the edge cache in the Invalidations page:

Object paths: /images/logo.png   (single file)
              /images/*          (wildcard, all images)
              /*                 (whole site)

Invalidations usually complete within minutes, but each one counts against a quota and frequent full-site purges incur fees. Use versioned URLs (such as style.v2.css) to reduce purge frequency.

Besides the console, you can invalidate from the CLI (install and configure the AWS CLI first):

aws cloudfront create-invalidation \
  --distribution-id E123ABC456DEF7 \
  --paths "/images/*" "/index.html"

Wire this into your release script so every deploy clears the relevant paths automatically instead of relying on a human clicking through the console. Watch the wildcards and the quota: each invalidation counts at least one path, the free allowance is 1,000 paths per month, and each additional path costs about $0.005. /* counts as one path but empties every edge location — use it sparingly.

Pricing and When to Choose It

CloudFront bills by data transfer and requests. You can use Price Classes to restrict delivery to North America, Europe, or Asia and lower costs — see CDN cost optimization guide.

Choose CloudFront when: your site already runs on AWS, you need seamless S3/ALB integration, you need signed URLs to protect private content, or you want delivery combined with the AWS WAF/Shield security stack. If you run multiple CDNs for failover, pair it with multi-CDN load balancing setup.

Cost Reference and Common Issues

CloudFront pricing is dominated by egress data transfer and requests: from us-east-1 to the internet, transfer starts around $0.085/GB plus request fees (on the order of $0.01 per 10,000 HTTP requests). If your site only needs certain regions, narrowing the Price Class to "North America/Europe" or "Asia" saves a meaningful amount; S3-origin egress through CloudFront also qualifies for a dedicated discount. For cost pressure, see CDN cost optimization guide.

The three most common problems:

  • Alternate domain not working: make sure the ACM certificate is in us-east-1 and the distribution status is Enabled before changing DNS.
  • Protecting private content: use signed URLs/signed cookies (set Signing Behavior to Restrict Viewer Access) with keys in a CloudFront Key Group, never in code.
  • Troubleshooting origin failures: check that the origin security group allows CloudFront's origin access, confirm OAC/OAI is configured correctly, then inspect origin request headers (Host, User-Agent).

16IDC Take

CloudFront's strength is not having the most nodes but its deep integration with the AWS ecosystem: S3 egress through CloudFront sharply cuts transfer costs, OAC keeps the origin invisible, and signed URLs suit paid content and download sites. For budget-sensitive small sites whose origin lives outside AWS, compare providers first — Azure side see Azure Front Door, Google side see Google Cloud CDN, and overall selection in our CDN provider selection guide. More content in the CDN acceleration category.

Reference: AWS CloudFront documentation https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/; invalidation and quotas https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Invalidation.html; source https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-creating-console.html