Cloud Parts

Amazon CloudFront

AWS’s CDN: more than 750 edge locations that cache your S3 files and front your load balancers and APIs.

What it is
CDNs
Type
Managed service on AWS
Made by
Amazon Web Services
License
Proprietary
Facts checked
5 October 2026
Website

What it is

You create a distribution, which gets a domain like d111111abcdef8.cloudfront.net, and point it at one or more origins: an S3 bucket, a load balancer, API Gateway, or any HTTP server. Cache behaviours match URL path patterns such as /api/* or /assets/*, and each one picks an origin and its own caching rules. By default an object stays in an edge cache for 24 hours unless the origin’s headers say otherwise. On a miss, the edge location asks a larger regional edge cache before going to the origin, so the origin sees far fewer requests.

Two kinds of edge code run inside it. CloudFront Functions are tiny JavaScript functions (up to 10 KB) that run in under a millisecond on every request, good for redirects, header changes and cache-key cleanup. Lambda@Edge runs Node.js or Python for up to 30 seconds and can call the network. What sets CloudFront apart is how it fits into AWS: fetching cacheable content from AWS origins such as S3, ALB or API Gateway costs nothing for data transfer, and you pay only for bytes and requests going out to viewers. AWS also offers flat-rate plans, from free to $1,000 a month, that bundle the CDN with WAF, DNS and no overage charges.

Why teams pick it

  • Data transfer of cacheable content from AWS origins such as S3, ALB and API Gateway to CloudFront is free
  • Always-free tier of 1 TB out, 10 million requests and 2 million CloudFront Functions invocations a month
  • Origin access control lets you keep an S3 bucket private and serve it only through the distribution
  • Per-path cache behaviours let one domain serve static files from S3 and dynamic requests from a load balancer

Watch out for

  • ACM certificates for a distribution must be issued in us-east-1, whatever region the rest of your stack is in
  • Only the first 1,000 invalidation paths a month are free; use versioned file names instead of purging
  • Default ceilings of 150 Gbps and 250,000 requests per second per distribution need a quota request to raise
  • Lambda@Edge on viewer events gets only 128 MB of memory and can return at most 40 KB

Alternatives

What all cdns have in common →
CloudflareCommercialA global reverse-proxy network that puts a CDN, DNS, DDoS protection and a WAF in front of your site.Cloudflare PagesCommercialGit-connected hosting for static and full-stack sites: every push is built and deployed to Cloudflare’s CDN with its own preview URL, and a `functions/` folder becomes Workers behind the site. Cloudflare now tells new projects to use Workers instead.

How it fits with other technologies

Deploy a static site to S3 and purge the cached HTML · bash

aws s3 sync ./dist s3://acme-site --delete

aws cloudfront create-invalidation \
  --distribution-id E2QWRUHEXAMPLE \
  --paths "/index.html" "/about/*"

aws cloudfront wait invalidation-completed \
  --distribution-id E2QWRUHEXAMPLE --id I2J0I21PCUYOIK

See it in a real stack

Serverless web app on AWS →
Live model
What you’re watchingPage loads go to CloudFront and are mostly cache hits; misses fetch from S3. API calls go to API Gateway, pass its throttle and run on Lambda, which reads and writes DynamoDB. Watch Lambda add instances, with cold starts in amber, when calls bunch up.
CQRS with a static read sideCommands update PostgreSQL; a Lambda projector rewrites the affected JSON views in S3, and CloudFront serves every read without touching a database.Amazon API GatewayAWS LambdaPostgreSQLAmazon SQSAmazon S3Amazon CloudFront
Where it came from2008–2025

When S3 launched in 2006, customers soon asked AWS for a way to secure and speed up delivery of their files to users around the world. The established CDNs, such as Akamai and Limelight, sold their service on long-term contracts, which suited big media companies better than small ones.

AWS launched Amazon CloudFront in beta on 18 November 2008 with 14 edge locations: eight in the US, four in Europe and two in Asia. It worked the AWS way, with no contract and a pay-as-you-go price starting at $0.17 per GB in the US and Europe. At first every origin had to be an S3 bucket and there was no HTTPS.

CloudFront then grew in steps. Custom origins in 2010 let it front any web server, regional edge caches in 2016 added a middle tier to protect origins, and Lambda@Edge, previewed the same year, began a line of edge code that led to CloudFront Functions in 2021. Today it has more than 750 edge locations.

Why it’s built this way

Pay as you go, no contracts
Traditional CDNs locked customers into long-term deals. Metered, self-service pricing matched the rest of AWS and opened CDNs to small companies.
Start with S3 as the only origin
The demand came from S3 users, so the first version only cached objects from S3 buckets. Support for any HTTP server followed two years later.
A regional cache tier between edge and origin
With hundreds of edge locations, each miss going straight to the origin multiplied its load. Larger regional edge caches, added in 2016, catch many of those misses first.
Run code at the edge in two sizes
Lambda@Edge handles heavier logic with network access, while CloudFront Functions (2021) run tiny JavaScript on every request in under a millisecond, cheap enough for header rewrites and redirects.

Timeline

  1. 2008

    CloudFront launches in beta on 18 November with 14 edge locations

  2. 2010

    Custom origins let it serve from any HTTP server, not just S3

  3. 2016

    Regional edge caches added; Lambda@Edge previewed (GA in July 2017)

  4. 2021

    CloudFront Functions run lightweight JavaScript on every request

  5. 2022

    HTTP/3 support; origin access control succeeds the older origin access identity

  6. 2025

    Flat-rate plans from $0 to $1,000 a month bundle CDN, WAF and DNS

Sources15 · facts checked 5 October 2026

Improve this page on GitHub