CloudFront CDN Guide

Resources:
  WebDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Comment: "Production web application"
        DefaultRootObject: index.html
        HttpVersion: http2and3
        PriceClass: PriceClass_100   # US, Canada, Europe only (cheapest)

        # Origins - where CloudFront fetches content
        Origins:
          - Id: S3StaticAssets
            DomainName: !GetAtt AssetsBucket.RegionalDomainName
            S3OriginConfig:
              OriginAccessIdentity: ""
            OriginAccessControlId: !Ref S3OAC

          - Id: APIBackend
            DomainName: !GetAtt ApplicationLoadBalancer.DNSName
            CustomOriginConfig:
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
              OriginSSLProtocols:
                - TLSv1.2
            OriginCustomHeaders:
              - HeaderName: X-Custom-Header
                HeaderValue: !Ref SecretHeaderValue

        # Default behavior (static assets from S3)
        DefaultCacheBehavior:
          TargetOriginId: S3StaticAssets
          ViewerProtocolPolicy: redirect-to-https
          CachePolicyId: !Ref StaticAssetsCachePolicy
          Compress: true
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD

        # Additional behaviors for specific paths
        CacheBehaviors:
          - PathPattern: "/api/*"
            TargetOriginId: APIBackend
            ViewerProtocolPolicy: https-only
            CachePolicyId: !Ref APICachePolicy
            OriginRequestPolicyId: !Ref APIOriginRequestPolicy
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
              - PUT
              - POST
              - PATCH
              - DELETE

          - PathPattern: "/static/*"
            TargetOriginId: S3StaticAssets
            ViewerProtocolPolicy: redirect-to-https
            CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6  # CachingOptimized managed policy
            Compress: true

        # Custom error pages
        CustomErrorResponses:
          - ErrorCode: 404
            ResponseCode: 200
            ResponsePagePath: /index.html  # SPA fallback
            ErrorCachingMinTTL: 10
          - ErrorCode: 403
            ResponseCode: 200
            ResponsePagePath: /index.html
            ErrorCachingMinTTL: 10

        # SSL certificate
        ViewerCertificate:
          AcmCertificateArn: !Ref Certificate
          SslSupportMethod: sni-only
          MinimumProtocolVersion: TLSv1.2_2021

        Aliases:
          - www.example.com
          - example.com

        # Enable WAF
        WebACLId: !GetAtt WebACL.Arn

Resources:
  # Origin Access Control
  S3OAC:
    Type: AWS::CloudFront::OriginAccessControl
    Properties:
      OriginAccessControlConfig:
        Name: S3-OAC
        OriginAccessControlOriginType: s3
        SigningBehavior: always
        SigningProtocol: sigv4

  # S3 bucket policy allowing CloudFront access
  AssetsBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref AssetsBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowCloudFrontServicePrincipal
            Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
            Action: s3:GetObject
            Resource: !Sub "${AssetsBucket.Arn}/*"
            Condition:
              StringEquals:
                AWS:SourceArn: !Sub "arn:aws:cloudfront::${AWS::AccountId}:distribution/${WebDistribution}"

Resources:
  # Cache policy for static assets (aggressive caching)
  StaticAssetsCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: StaticAssets-CachePolicy
        DefaultTTL: 86400         # 1 day
        MaxTTL: 31536000          # 1 year
        MinTTL: 3600              # 1 hour minimum
        ParametersInCacheKeyAndForwardedToOrigin:
          EnableAcceptEncodingGzip: true
          EnableAcceptEncodingBrotli: true
          CookiesConfig:
            CookieBehavior: none
          HeadersConfig:
            HeaderBehavior: none
          QueryStringsConfig:
            QueryStringBehavior: none

  # Cache policy for API responses (short caching)
  APICachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: API-CachePolicy
        DefaultTTL: 0             # No caching by default
        MaxTTL: 300               # Max 5 minutes
        MinTTL: 0
        ParametersInCacheKeyAndForwardedToOrigin:
          EnableAcceptEncodingGzip: true
          EnableAcceptEncodingBrotli: true
          CookiesConfig:
            CookieBehavior: none
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers:
              - Authorization   # Different cache entries per auth token
          QueryStringsConfig:
            QueryStringBehavior: all  # Include all query strings in cache key

  # Origin request policy for API (forward everything to origin)
  APIOriginRequestPolicy:
    Type: AWS::CloudFront::OriginRequestPolicy
    Properties:
      OriginRequestPolicyConfig:
        Name: API-OriginRequestPolicy
        CookiesConfig:
          CookieBehavior: all
        HeadersConfig:
          HeaderBehavior: allViewerAndWhitelistCloudFront
          Headers:
            - CloudFront-Viewer-Country
            - CloudFront-Is-Mobile-Viewer
        QueryStringsConfig:
          QueryStringBehavior: all

  # Response headers policy (security headers)
  SecurityHeadersPolicy:
    Type: AWS::CloudFront::ResponseHeadersPolicy
    Properties:
      ResponseHeadersPolicyConfig:
        Name: SecurityHeaders
        SecurityHeadersConfig:
          StrictTransportSecurity:
            AccessControlMaxAgeSec: 31536000
            IncludeSubdomains: true
            Override: true
          ContentTypeOptions:
            Override: true
          FrameOptions:
            FrameOption: DENY
            Override: true
          XSSProtection:
            ModeBlock: true
            Protection: true
            Override: true
          ReferrerPolicy:
            ReferrerPolicy: strict-origin-when-cross-origin
            Override: true
          ContentSecurityPolicy:
            ContentSecurityPolicy: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
            Override: true

// CloudFront Function: URL rewrite for SPA routing
// Trigger: Viewer Request
function handler(event) {
  var request = event.request;
  var uri = request.uri;

  // If the URI has a file extension, serve it as-is
  if (uri.includes('.')) {
    return request;
  }

  // For all other paths, serve index.html (SPA routing)
  request.uri = '/index.html';
  return request;
}

// CloudFront Function: Add security headers
// Trigger: Viewer Response
function handler(event) {
  var response = event.response;
  var headers = response.headers;

  headers['strict-transport-security'] = { value: 'max-age=63072000; includeSubDomains; preload' };
  headers['x-content-type-options'] = { value: 'nosniff' };
  headers['x-frame-options'] = { value: 'DENY' };
  headers['x-xss-protection'] = { value: '1; mode=block' };
  headers['referrer-policy'] = { value: 'strict-origin-when-cross-origin' };

  return response;
}

// CloudFront Function: Redirect www to non-www
// Trigger: Viewer Request
function handler(event) {
  var request = event.request;
  var host = request.headers.host.value;

  if (host.startsWith('www.')) {
    return {
      statusCode: 301,
      statusDescription: 'Moved Permanently',
      headers: {
        location: { value: 'https://' + host.replace('www.', '') + request.uri }
      }
    };
  }

  return request;
}

// Lambda@Edge: JWT authentication at the edge
// Trigger: Viewer Request
// Region: Must be deployed in us-east-1
import jwt from "jsonwebtoken";

const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
-----END PUBLIC KEY-----`;

export const handler = async (event: any) => {
  const request = event.Records[0].cf.request;
  const headers = request.headers;

  // Skip auth for public paths
  if (request.uri.startsWith("/public/") || request.uri === "/health") {
    return request;
  }

  const authHeader = headers.authorization?.[0]?.value;
  if (!authHeader || !authHeader.startsWith("Bearer ")) {
    return {
      status: "401",
      statusDescription: "Unauthorized",
      headers: {
        "content-type": [{ key: "Content-Type", value: "application/json" }],
        "www-authenticate": [{ key: "WWW-Authenticate", value: "Bearer" }],
      },
      body: JSON.stringify({ error: "Missing or invalid authorization header" }),
    };
  }

  try {
    const token = authHeader.replace("Bearer ", "");
    const decoded = jwt.verify(token, PUBLIC_KEY, {
      algorithms: ["RS256"],
    }) as { sub: string; email: string };

    // Pass user info to origin via custom headers
    request.headers["x-user-id"] = [{ key: "X-User-Id", value: decoded.sub }];
    request.headers["x-user-email"] = [{ key: "X-User-Email", value: decoded.email }];

    return request;
  } catch (error) {
    return {
      status: "403",
      statusDescription: "Forbidden",
      headers: {
        "content-type": [{ key: "Content-Type", value: "application/json" }],
      },
      body: JSON.stringify({ error: "Invalid token" }),
    };
  }
};

import { getSignedUrl } from "@aws-sdk/cloudfront-signer";

// Generate a signed URL for premium content
function generateSignedUrl(resourcePath: string, expiresInSeconds: number): string {
  const url = `https://cdn.example.com${resourcePath}`;
  const keyPairId = "K2XXXXXXXXXX";  // CloudFront public key ID
  const privateKey = process.env.CLOUDFRONT_PRIVATE_KEY!;

  const signedUrl = getSignedUrl({
    url,
    keyPairId,
    privateKey,
    dateLessThan: new Date(Date.now() + expiresInSeconds * 1000).toISOString(),
  });

  return signedUrl;
}

// Generate a signed URL for a video stream
const videoUrl = generateSignedUrl("/premium/video-course-101.mp4", 3600); // 1 hour
console.log("Signed URL:", videoUrl);
// https://cdn.example.com/premium/video-course-101.mp4?Expires=...&Signature=...&Key-Pair-Id=...

# Request an ACM certificate (must be in us-east-1 for CloudFront)
aws acm request-certificate \
  --domain-name "example.com" \
  --subject-alternative-names "*.example.com" \
  --validation-method DNS \
  --region us-east-1

# After DNS validation, the certificate is issued automatically

# Create a Route 53 alias record pointing to CloudFront
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234567890 \
  --change-batch '{
    "Changes": [{
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "www.example.com",
        "Type": "A",
        "AliasTarget": {
          "HostedZoneId": "Z2FDTNDATAQYW2",
          "DNSName": "d1234567890.cloudfront.net",
          "EvaluateTargetHealth": false
        }
      }
    }]
  }'

# Invalidate specific paths
aws cloudfront create-invalidation \
  --distribution-id E1234567890 \
  --paths "/index.html" "/api/config.json"

# Invalidate all content (expensive for large sites)
aws cloudfront create-invalidation \
  --distribution-id E1234567890 \
  --paths "/*"

# Check invalidation status
aws cloudfront list-invalidations \
  --distribution-id E1234567890 \
  --query 'InvalidationList.Items[0].{Id:Id, Status:Status}'

# Enable standard logging to S3
aws cloudfront update-distribution \
  --id E1234567890 \
  --distribution-config '{
    "Logging": {
      "Enabled": true,
      "Bucket": "my-cf-logs.s3.amazonaws.com",
      "Prefix": "cdn-logs/",
      "IncludeCookies": false
    }
  }'

# Create a real-time log configuration
aws cloudfront create-realtime-log-config \
  --name production-realtime-logs \
  --sampling-rate 100 \
  --fields "timestamp" "c-ip" "cs-uri-stem" "sc-status" "cs-method" \
           "time-taken" "x-edge-result-type" "x-edge-response-result-type" \
  --end-points '{
    "StreamType": "Kinesis",
    "KinesisStreamConfig": {
      "RoleARN": "arn:aws:iam::123456789012:role/CloudFrontRealtimeLogRole",
      "StreamARN": "arn:aws:kinesis:us-east-1:123456789012:stream/cf-realtime-logs"
    }
  }'