CloudFront CDN: Setup and Optimization Guide

# Create CloudFront distribution for S3 bucket
aws cloudfront create-distribution \
  --origin-domain-name dodatech-site.s3.us-east-1.amazonaws.com \
  --default-root-object index.html \
  --enabled \
  --comment "DodaTech website"

# Output:
# {
#     "Distribution": {
#         "Id": "E1XAMPLE12345",
#         "DomainName": "d1234example.cloudfront.net",
#         "Status": "InProgress"
#     }
# }

# cloudfront.tf
resource "aws_cloudfront_distribution" "site" {
  origin {
    domain_name = aws_s3_bucket.site.bucket_regional_domain_name
    origin_id   = "S3-site"

    s3_origin_config {
      origin_access_identity = aws_cloudfront_origin_access_identity.oai.cloudfront_access_identity_path
    }
  }

  enabled             = true
  is_ipv6_enabled     = true
  default_root_object = "index.html"
  price_class         = "PriceClass_100"  # Only US/Europe (cheaper)

  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "S3-site"

    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "redirect-to-https"
    min_ttl                = 0
    default_ttl            = 3600   # 1 hour
    max_ttl                = 86400  # 1 day
    compress               = true
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }

  tags = {
    Name        = "dodatech-site"
    Environment = "production"
  }
}

# API behavior — no cache, forward all headers
ordered_cache_behavior {
  path_pattern     = "/api/*"
  target_origin_id = "ALB-origin"

  allowed_methods  = ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"]
  cached_methods   = ["GET", "HEAD"]

  forwarded_values {
    query_string = true
    headers      = ["Authorization", "Content-Type"]
    cookies {
      forward = "all"
    }
  }

  viewer_protocol_policy = "https-only"
  min_ttl                = 0
  default_ttl            = 0
  max_ttl                = 0
}

# Static assets — long cache, compress
ordered_cache_behavior {
  path_pattern     = "/static/*"
  target_origin_id = "S3-site"

  viewer_protocol_policy = "redirect-to-https"
  default_ttl            = 2592000  # 30 days
  compress               = true
}

# Show custom error pages instead of generic CloudFront errors
custom_error_response {
  error_code         = 403
  response_code      = 200
  response_page_path = "/error.html"  # SPA fallback
}

custom_error_response {
  error_code         = 404
  response_code      = 200
  response_page_path = "/error.html"
}

resource "aws_wafv2_web_acl" "cloudfront" {
  name        = "cloudfront-waf"
  scope       = "CLOUDFRONT"

  default_action {
    allow {}
  }

  rule {
    name     = "rate-limit"
    priority = 1

    action {
      block {}
    }

    statement {
      rate_based_statement {
        limit              = 5000
        aggregate_key_type = "IP"
      }
    }
  }

  rule {
    name     = "block-bad-ips"
    priority = 2

    action {
      block {}
    }

    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.blocked.arn
      }
    }
  }
}

resource "aws_cloudfront_distribution" "site" {
  web_acl_id = aws_wafv2_web_acl.cloudfront.arn
  # ...
}

# generate_signed_url.py
import boto3
from datetime import datetime, timedelta

def generate_signed_url(distribution_url, private_key_path, key_pair_id, expire_hours=24):
    signer = boto3.client('cloudfront')
    url = f"{distribution_url}/private/signatures-v2.db"
    expiry = datetime.now() + timedelta(hours=expire_hours)

    signed_url = signer.sign_url(
        url=url,
        keypair_id=key_pair_id,
        private_key=private_key_path,
        expire_time=expiry
    )
    return signed_url

url = generate_signed_url(
    "https://d1234example.cloudfront.net",
    "/path/to/private-key.pem",
    "KEXAMPLE12345"
)
print(f"Signed URL (expires in 24h):\n{url}")

# Output:
# https://d1234example.cloudfront.net/private/signatures-v2.db?...
#   Expires=1718899200&Signature=abc123...&Key-Pair-Id=KEXAMPLE12345

# lambda_edge_viewer_request.py
# Redirect mobile users to mobile site
import json

def lambda_handler(event, context):
    request = event['Records'][0]['cf']['request']
    headers = request['headers']

    # Check User-Agent for mobile
    if 'user-agent' in headers:
        ua = headers['user-agent'][0]['value'].lower()
        if any(w in ua for w in ['mobile', 'android', 'iphone']):
            response = {
                'status': '302',
                'statusDescription': 'Found',
                'headers': {
                    'location': [{
                        'key': 'Location',
                        'value': f"https://m.example.com{request['uri']}"
                    }]
                }
            }
            return response
    return request

# Enable CloudFront logging
resource "aws_cloudfront_distribution" "site" {
  logging_config {
    include_cookies = false
    bucket          = aws_s3_bucket.logs.bucket_domain_name
    prefix          = "cloudfront/"
  }
}

# CloudFront metrics in CloudWatch / Prometheus
# Total requests per distribution
aws_cloudfront_requests_sum{distribution_id="E1XAMPLE12345"}

# Error rate (4xx + 5xx)
aws_cloudfront_error_rate_sum{distribution_id="E1XAMPLE12345"}

# Data transfer in GB
aws_cloudfront_bytes_downloaded_sum{distribution_id="E1XAMPLE12345"}