Global Edge Network
Reliable, low latency and high throughput network connectivity
Network Connectivity and Backbone
Amazon CloudFront peers with thousands of Tier 1/2/3 telecom carriers globally, is well connected with all major access networks for optimal performance, and has hundreds of terabits of deployed capacity. CloudFront Edge locations are connected to the AWS Regions through the AWS network backbone - fully redundant, multiple 100GbE parallel fiber that circles the globe and links with tens of thousands of networks for improved origin fetches and dynamic content acceleration.
To deliver content to end users with lower latency, Amazon CloudFront uses a global network of 225+ Points of Presence (215+ Edge locations and 13 regional mid-tier caches) in 90 cities across 47 countries. Amazon CloudFront Edge locations are located in:
Edge locations: Ashburn, VA (6); Atlanta, GA (6); Boston, MA (3); Chicago, IL (6); Dallas/Fort Worth, TX (6); Denver, CO (2); Hayward, CA; Hillsboro, OR (3); Houston, TX (4); Jacksonville, FL; Los Angeles, CA (5); Miami, FL (4); Minneapolis, MN; Montreal, QC; New York, NY (2); Newark, NJ (7); Palo Alto, CA; Philadelphia, PA (2); Phoenix, AZ (2); Salt Lake City, Utah; San Jose, CA (2); Seattle, WA (3); Toronto, ON (2); Vancouver, BC ; Querétaro, MX (2)
Regional Edge caches: California; Ohio; Oregon; Virginia;
Edge locations: Amsterdam, The Netherlands (2); Athens, Greece; Berlin, Germany (2); Brussels, Belgium; Bucharest, Romania; Budapest, Hungary; Copenhagen, Denmark; Dublin, Ireland; Dusseldorf, Germany; Frankfurt, Germany (10); Hamburg, Germany; Helsinki, Finland; Lisbon, Portugal; London, England (9); Madrid, Spain (3); Manchester, England (2); Marseille, France; Milan, Italy (3); Munich, Germany (2); Oslo, Norway; Palermo, Italy; Paris, France (5); Prague, Czech Republic; Rome, Italy; Sofia, Bulgaria; Stockholm, Sweden (3); Vienna, Austria; Warsaw, Poland; Zagreb, Croatia; Zurich, Switzerland (2)
Regional Edge caches: Dublin, Ireland; Frankfurt, Germany; London, England
Edge locations: Bangalore, India (3); Bangkok, Thailand (2); Chennai, India (4); Hong Kong, China (3); Hyderabad, India (3); Jakarta, Indonesia; Kolkata, India (2); Kuala Lumpur, Malaysia (2); Mumbai, India (4); Manila, Philippines; New Delhi, India (5); Osaka, Japan; Seoul, South Korea (4); Singapore (4); Taipei, Taiwan(3); Tokyo, Japan (16)
Regional Edge caches: Mumbai, India; Singapore; Seoul, South Korea; Tokyo, Japan
Edge locations: Auckland, NZ (2); Melbourne, AU (2); Perth, AU; Sydney, AU (4);
Regional Edge caches: Sydney
Edge locations: Bogota, Colombia; Buenos Aires, Argentina; Rio de Janeiro, Brazil (2); Santiago, Chile; São Paulo, Brazil (2)
Regional Edge caches: São Paulo, Brazil
Edge location: Dubai, United Arab Emirates; Fujairah, United Arab Emirates; Manama, Bahrain; Tel Aviv, Israel
Edge locations: Cape Town, South Africa; Johannesburg, South Africa; Nairobi, Kenya
Edge locations: Beijing; Shenzhen; Shanghai; Zhongwei
Protection against Network and Application Layer Attacks
Amazon CloudFront, AWS Shield, AWS Web Application Firewall (WAF), and Amazon Route 53 work seamlessly together to create a flexible, layered security perimeter against multiple types of attacks including network and application layer DDoS attacks. All of these services co-reside at the AWS edge and provide a scalable, reliable, and high-performance security perimeter for applications and content. With CloudFront as the “front door” to an application and infrastructure, the primary attack surface is moved away from critical content, data, code and infrastructure. Learn more about AWS Best Practices for DDoS Resiliency.
SSL/TLS Encryptions and HTTPS
With Amazon CloudFront, content, APIs or applications can be delivered over HTTPS using the latest version Transport Layer Security (TLSv1.3) to encrypt and secure communication between viewer clients and CloudFront. AWS Certificate Manager (ACM) can be used to easily create a custom SSL certificate and deploy to an CloudFront distribution for free. ACM automatically handles certificate renewal, eliminating the overhead and costs of a manual renewal process. Additionally, CloudFront provides a number of TLS optimizations and advanced capabilities such as full/half bridge HTTPS connections, OCSP stapling, Session Tickets, Perfect Forward Secrecy, TLS Protocol Enforcements and Field-Level Encryption.
With Amazon CloudFront, access is restricted to content through a number of capabilities. With Signed URLs and Signed Cookies, Token Authentication is supported to restrict access to only authenticated viewers. Through geo-restriction capability, users can be prevented in specific geographic locations from accessing content that is distributed through CloudFront. With Origin Access Identity (OAI) feature, access can be restricted to an Amazon S3 bucket, making it only accessible from CloudFront. Learn more.
CloudFront infrastructure and processes are all compliant with PCI-DSS Level 1, HIPAA, and ISO 9001, ISO/IEC 27001:2013, 27017:2015, 27018:2019, SOC (1, 2 and 3), FedRAMP Moderate and more to ensure secure delivery for sensitive data.
Web applications often need to contend with spikes in traffic during peak periods of activity. By using Amazon CloudFront, the volume of application origin requests is automatically reduced. Content is stored in CloudFront’s edge and regional caches and only fetched from origins when needed. The load on application origins can be further reduced by using Origin Shield to enable a centralized caching layer. Origin Shield optimizes cache hit ratios and collapses requests across regions leading to as few as one origin request per object. This reduced traffic to your origins helps increase the availability of your applications.
Enabling redundancy for origins
CloudFront supports multiple origins for backend architecture redundancy. CloudFront’s native origin failover capability automatically serves content from a backup origin when the primary origin is unavailable. The origins set up with origin failover can be any combination of AWS origins like EC2 instances, Amazon S3 buckets, or Media Services, or non-AWS origins like an on-premises HTTP server. Additionally, you can implement advanced origin failover capabilities with CloudFront and Lambda@Edge like here.
AWS Lambda@Edge is a general-purpose serverless compute feature that supports a wide range of computing needs and customizations. Lambda@Edge is best suited for computationally intensive operations. This could be computations that take longer to complete (several milliseconds to seconds), take dependencies on external 3rd party libraries, require integrations with other AWS services (e.g., S3, DynamoDB), or need networks calls for data processing. Some of the popular advanced use cases include HLS streaming manifest manipulation, integrations with 3rd party authorization and bot detection services, server-side rendering (SSR) of single-page apps (SPA) at the edge and more. Learn more. >>
Real-time Metrics and Logging
Amazon CloudFront is integrated with Amazon CloudWatch, and automatically publishes six operational metrics per distribution, which are displayed in a set of graphs in the CloudFront console. Additional, granular metrics are available with simple click on the console or via API.
Standard and Real-time Logging
CloudFront provides two ways to log the requests delivered from your distributions: Standard logs and Real-time logs. Standard logs are delivered to the Amazon S3 bucket of your choice (log records are delivered within minutes of a viewer request). When enabled, CloudFront will automatically publish detailed log information in a W3C extended format into an Amazon S3 bucket that you specify. CloudFront real-time logs are delivered to the data stream of your choice in Amazon Kinesis Data Streams (log records are delivered within seconds of a viewer request). You can choose the sampling rate for your real-time logs—that is, the percentage of requests for which you want to receive real-time log records. Learn more about CloudFront logging capabilities here.
Fast Change Propagation and Invalidations
CloudFront offers fast change propagation and invalidations, within a matter of minutes. Typically, changes are propagated to the edge in a matter of a few minutes, and invalidation times are under two minutes.
Full-featured APIs and DevOps Tools
Amazon CloudFront provides developers with a full-featured API to create, configure and maintain CloudFront distributions. In addition, developers have access to a number of tools such as AWS CloudFormation, CodeDeploy, CodeCommit and AWS SDKs to configure and deploy their workloads with Amazon CloudFront.
Your CloudFront Distribution can be configured with multiple behaviors which govern how CloudFront will process your request and what features will be applied. Take control of how CloudFront caches, how CloudFront communicates with your origin, customize what headers and metadata are forwarded to your origin, create content variants with flexible cache-key manipulation, support for various compression modes, and other customizations. With built-in device detection, CloudFront can detect the device type (Desktop, Tablet, Smart TV, or Mobile device) and pass that information in the form of new HTTP Headers to your application to easily adapt content variants or other responses. Amazon CloudFront can also detect the country-level location of the requesting user for further customization of the response.
Pricing options for every level of usage
CloudFront offers personalizable pricing options including pay-as-you-go, the CloudFront Security Savings Bundle, and custom pricing. Pay-as-you-go pricing is simple with no upfront fees. If you are looking for a discount, the CloudFront Security Savings Bundle that helps you save up to 30% on your CloudFront bill in exchange for a monthly spend commitment for a 1-year term. The savings bundle also includes free AWS WAF usage up to 10% of the monthly committed spend. For customers who are willing to make certain minimum traffic commitments (typically 10 TB/month or higher), we also offer additional discounts with private committed pricing.
Learn more about Amazon CloudFront pricing.
Free data Transfer between AWS cloud services and Amazon CloudFront for origin fetches
If AWS origins such as Amazon S3, Amazon EC2 or Elastic Load Balancing are used, there is no charge incurred for data transferred from origins to CloudFront Edge locations (this type of data transfer is known as origin fetch). To learn more about all Amazon CloudFront features, and how to configure them, please refer to the Amazon CloudFront Developer Guide.
Reduce Origin Operating Costs
Not all origins are alike and some may involve processes such as just-in-time packaging that are more computationally expensive per GB than fetching content out of storage. CloudFront provides regional edge caches at no additional cost to decrease the operational burden on origins and lower operating costs. Further reduction in origin-related costs are available using Origin Shield to minimize the number of origin fetches. Origin Shield provides centralized caching to optimize cache-hit ratios and collapse requests across regions resulting in as few as one origin request per object.
As part of the AWS Free Usage Tier, you can get started with Amazon CloudFront for free. Upon sign-up, new AWS customers receive 50 GB Data Transfer Out and 2,000,000 HTTP and HTTPS Requests each month for one year.
Instantly get access to the AWS Free Tier.
Follow our Getting Started Guide to start your first Amazon CloudFront distribution in a few clicks.