# CloudFront
## What is it?
[[_CloudFront|CloudFront]] is a CDN. It can be used for:
- Static & Dynamic content
- Video Streaming
- Web Sockets

### Benefits
- [[_CloudFront|CloudFront]] can be fronted with [[AWS WAF]] for OWASP's top 10 protection.
- [[_CloudFront|CloudFront]] can stream [[Videos On Demand]] using [[ISS Microsoft Smooth Streaming]]

### Core components
**Origin**: Location where all original files are located. Examples include: S3, EC2, ELB, Route53.
**Edge Locations**: Compute located strategically close to end users.
**Regional Caches**: Compute located in board geographical locations to speed up requests for edge locations.
**Distribution**: A collection of Edge locations and Regional Cache that defines how cached content should behave.

## Running Code
  
### Stages where [[Lambda@Edge]] and [[CloudFront Functions]] can trigger
The order that the functions trigger within CloudFront is:
| Order | Stage | L@E | CF Fns |  Description | Example Use Cases |
|--|---|---|---|---|--|
| 1 |  Viewer Request |  ✔️ |  ✔️ |  When CloudFront receives a request from the viewer. | Redirection (`HTTP` -> `HTTPS`), Cookie Inspection for Auth, Modify Headers for A/B Testing  |
| 2 |  Origin Request |  ✔️ |  ❌ |  Before CloudFront forwards the request to the origin. | Add security headers (CSP/HSTS), set cookies for client side tracking, customise error messages |
| 3 |  Origin Response |  ✔️ |  ❌ |  After CloudFront receives the request from the origin. | Rewrite URLs for SEO or routing, inject headers for origin authentication, selective content serving based on user agent (desktop/mobile mode). |
| 4 |  Viewer Response |  ✔️ |  ✔️ |  Before CloudFront returns the response to the viewer. | Modify headers to control caching, update URLs in HTML for versioning, customise error responses from origin.  |

```mermaid
sequenceDiagram
    participant Viewer
    participant Edge
    participant Origin

    Viewer->>Edge: Viewer Request
    Edge->>Origin: Origin Request
    Origin->>Edge: Origin Response
    Edge->>Viewer: Viewer Response
```

### Difference between [[Lambda@Edge]] and [[CloudFront Functions]]
|   |  CF Fns |  L@E |
|---|---|---|
|  Programming Languages |  JavaScript (ECMAScript 5.1) |  Node.JS and Python |
|  Event Sources |  Viewer only |  Viewer and Origin |
|  Scale |  +10,000,000 requests/s |  10,000 requests/s/Region |
|  Function Duration |  Submilisecond |  Up to 5s (Viewer) / Up to 30s (Origin) |
|  Max Memory |  2MB |  128MB-3,008MB |
|  Max Bundle Size |  10KB |  1MB (Viewer) / 50MB (Origin) |
|  Network, File System, and Request Body Access |  ❌ |  ✔️ |
|  Access to geolocation |  ✔️ |  ❌ (Viewer request) / ✔️ (Origin request & response, Viewer response) |
|  Can build/test entirely within CloudFront |  ✔️ |  ❌ |
|  Functions logging and metrics |  ✔️ |  ✔️ |
|  Pricing |  Cheaper. Free tier available; charged pre request. |  More expensive. Charged per request & function duration. |

## CloudFront Origin
It's the source where CloudFront will send requests.

### CloudFront Origin Groups
It allows you to group a **primary** and **secondary origin** together as a destination for requests to enable high availability and fault tolerance.

The **Primary Origin** is where **all** the requests will be sent.
The **Secondary Origin** is where the requests will be sent if the **Primary Origin** is **not available**. It will act like a **failover** origin.

The **failover** criteria is based on **HTTP Status Codes**: 400, 403, 404, 416, 500, 502, 503, 504.

CloudFront will failover on: `GET`, `HEAD`, and `OPTION` requests.
CloudFront will NOT failover on: `PUT`, `POST`, `PATCH`, and `DELETE`.

## CloudFront Caching Policy
### Cache Key
The **Cache Key** is a unique identifier for every object in the cache and determines whether a viewer request results in a cache hit.
A cache hit occurs when a viewer request generates the same **Cache Key** as a prior request and the object for that cache key is in the edge location's cache.
The more people hit the cache, the better the application performance will be.

### Cache Policy
A **Cache Policy** determines the **Cache Key**.

AWS has managed **Cache Policies** for use:
- `Amplify`
- `CachingDisabled`
- `CachingOptimized`
- `CachingOptimizedForUncompressedObjects`
- `Elemental-MediaPackage`

You can make your own **Caching Policy**:
- **TTL Settings**:
    - **Minimum** / **Maximum** **TTL**: min / max time to hold the file in the cache.
    - **Default TTL**: default time to hold a file in the cache.

- **Cache Key Settings**:
    - **Headers**: which headers are a part of the **Cache Key**.
    - **Cookies**: which cookies are a part of the **Cache Key**.
    - **Query String**: which query string parameters are a part of the **Cache Key**.
    - **Compression Support**: What compression format is part of the **Cache Key**.