Cloudfront V2

CloudFront is the natural CDN choice for AWS-native architectures — deep integration with S3, EC2, ALB, API Gateway, and Lambda@Edge. For agents: the key automation use case is cache invalidation after deployments (invalidate cached assets when a new version deploys), distribution management (create/update distributions for new applications), and real-time log access (query delivery analytics). CloudFront Functions and Lambda@Edge enable edge-side request/response manipulation. Free tier (1TB/month, 10M requests) is generous. Confidence is docs-derived.

CloudFront API via boto3 (Python). cloudfront.create_distribution(DistributionConfig={Origins, DefaultCacheBehavior, CacheBehaviors, Enabled}). cloudfront.create_invalidation(DistributionId, InvalidationBatch={Paths:{Quantity:1,Items:["/path/*"]},CallerReference:uuid}) — clears cached content. cloudfront.get_distribution(Id) retrieves distribution config + status. cloudfront.update_distribution(DistributionConfig, Id, IfMatch) updates distribution (requires ETag from get_distribution). cloudfront.list_distributions() lists all distributions. cloudfront.get_invalidation(DistributionId, Id) retrieves invalidation status. Lambda@Edge: associate Lambda functions with CloudFront events (viewer-request, origin-request, etc.) via distribution CacheBehavior.LambdaFunctionAssociations. CloudFront Functions: lighter alternative for simple header manipulation.

IAM-based auth: SigV4 via boto3. IAM roles: cloudfront:CreateDistribution, cloudfront:UpdateDistribution, cloudfront:CreateInvalidation, cloudfront:GetDistribution. HTTPS enforced on CloudFront endpoint. ACM certificates: provision via ACM (us-east-1 region required for CloudFront certificates — a common gotcha). Signed URLs/Cookies: for private content access control — sign with CloudFront key pair. Origin Access Control (OAC): restricts S3 origin to CloudFront-only access (replaces OAI). WAF integration: attach AWS WAF to CloudFront for edge filtering.

Distribution changes: async — update_distribution returns operation; deployment takes 5-15 minutes to propagate globally. Invalidation: takes 1-5 minutes; free up to 1000 paths/month (charged beyond). ETag management: update_distribution requires current ETag (optimistic concurrency control — get fresh ETag before update). CloudFront uptime at status.aws.amazon.com. Cache behaviors: complex configuration — incorrect behavior ordering causes unexpected routing. Regional edge cache: CloudFront has two tiers (edge PoPs + regional cache) — invalidation clears both. ACM certificate in us-east-1: non-obvious regional constraint for CloudFront.

docs.aws.amazon.com/cloudfront covers distribution configuration reference, invalidation guide, Lambda@Edge guide, CloudFront Functions reference, and security configuration. Getting started: AWS free tier, boto3 cloudfront client, create first distribution in under 15 minutes. boto3: pip install boto3. Cache invalidation automation: common pattern in CI/CD pipelines (run after deployment). Community via AWS re:Post and Stack Overflow (amazon-cloudfront tag). Mature AWS service with comprehensive documentation.