Amazon CloudFront
CDN, reverse proxy, and WAF attachment point at once, the caching cost rule, and the signed URL TTL mismatch that quietly extends access.
- CDN. Caches content at edge locations near users so most requests never reach the origin.
- Reverse proxy. Every request, static assets or API calls, can go through one CloudFront distribution first. The browser never talks to the origin (S3, API Gateway) directly.
- Security checkpoint. Because every request already passes through one place, that's the natural spot to attach a WAF. Catches attacks before they reach application code.
The caching cost rule
Cache as far out from the application as possible. Edge caching at CloudFront is cheaper than caching at the API layer, which is cheaper than caching at the database layer. Push it outward before adding it anywhere closer in.
Private content and signed URLs
CloudFront can front a private origin (an S3 bucket with no direct public access via Origin Access Identity) and serve it through signed URLs, temporary, scoped links to one object.
The gotcha: CloudFront's own cache TTL is a separate setting from the signed URL's expiry. If the cache TTL is longer than the signed URL's TTL, CloudFront keeps serving the cached bytes past the point the URL should have stopped working, it has no idea the underlying URL expired, it just knows its own cache hasn't. CloudFront's TTL should always be equal to or shorter than the signed URL's TTL.
Where this showed up
- The frontend that never touches a password: the three-job setup.
- A cache doesn't know a token expired: the TTL mismatch.