AWS CloudFront CDN Setup Turnkey

When launching a site on AWS, global users often face slow loading. TTFB above 500 ms, LCP spikes, and the server can't handle peak load. Without a CDN, this is normal. We configure AWS CloudFront so that response times drop by 2–3× and origin load falls by 90%. Our experience: 5+ years working with AWS, 50+ projects, certified engineers. We guarantee SLA and round‑the‑clock support.

How CloudFront Speeds Up Your Site

CloudFront is Amazon's CDN with 450+ edge locations worldwide. Instead of always hitting your server, it delivers cached content from the nearest node. This radically reduces TTFB (first 50 ms) and improves Core Web Vitals: LCP, CLS, INP. Additionally, CloudFront supports HTTP/2, automatic Brotli/Gzip compression, and stale-while-revalidate. Traffic savings can reach 60% thanks to compression and edge caching.

Typical cache policies for different content types:

Why Choose CloudFront for AWS Infrastructure?

CloudFront deeply integrates with AWS—S3, ALB, API Gateway, Lambda@Edge. You can:

• Attach an SSL certificate via ACM for free.
• Use Origin Shield for an additional cache layer between edge and origin.
• Run custom logic on Edge Functions (CloudFront Functions or Lambda@Edge) with no latency.

Comparison with other CDNs:

CloudFront is the best fit if your infrastructure is already on AWS. It gives you full control over caching and security.

Real Problems CloudFront Solves

In one project with 100,000 unique daily visitors, we reduced TTFB from 800 ms to 40 ms after configuring CloudFront with Origin Shield and proper cache policies. Origin load dropped 50× and traffic costs decreased by 40%. Origin Shield is a second cache layer between edge and origin that aggregates requests and reduces load. Recommended for projects with thousands of requests per second.

Our Setup Process

1. Analysis: We study your site architecture, determine which resources to cache and which APIs to bypass.
2. Design: We design the distribution, cache policies, behaviors, and Origin Shield.
3. Implementation: We write Terraform configurations, set up SSL via ACM, and connect S3 for static content.
4. Testing: We verify cache headers, invalidation, and load speed in different regions.
5. Deployment: We deploy via CI/CD and document the process.

What's Included in the Work

• Documentation of the configuration and developer instructions.
• Access to CloudFront, ACM, S3 with minimal privileges.
• Training for your team: how to manage cache and create invalidations.
• One month of post‑launch support—fixing any unexpected issues.
• Monitoring via CloudWatch with alerts for errors and latencies.
• Performance report with metrics (TTFB, LCP, CLS) before and after implementation.

Example Terraform Configuration

# main.tf — creating a CloudFront distribution
resource "aws_cloudfront_distribution" "main" {
  enabled = true
  is_ipv6_enabled = true
  default_root_object = "index.html"
  price_class = "PriceClass_200"

  # Main origin — Laravel on EC2/ALB
  origin {
    domain_name = aws_lb.main.dns_name
    origin_id = "alb-origin"
    custom_origin_config {
      http_port = 80
      https_port = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols = ["TLSv1.2"]
    }
    custom_header {
      name = "X-Origin-Verify"
      value = var.origin_verify_token
    }
  }

  # S3 origin for static files
  origin {
    domain_name = aws_s3_bucket.assets.bucket_regional_domain_name
    origin_id = "s3-assets"
    origin_access_control_id = aws_cloudfront_origin_access_control.main.id
    origin_shield {
      enabled = true
      origin_shield_region = "eu-central-1"
    }
  }

  # Static assets from S3
  ordered_cache_behavior {
    path_pattern = "/assets/*"
    target_origin_id = "s3-assets"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods = ["GET", "HEAD"]
    cached_methods = ["GET", "HEAD"]
    compress = true
    cache_policy_id = aws_cloudfront_cache_policy.assets.id
  }

  # API — no cache
  ordered_cache_behavior {
    path_pattern = "/api/*"
    target_origin_id = "alb-origin"
    viewer_protocol_policy = "https-only"
    allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
    cached_methods = ["GET", "HEAD"]
    cache_policy_id = data.aws_cloudfront_cache_policy.caching_disabled.id
    origin_request_policy_id = data.aws_cloudfront_origin_request_policy.all_viewer.id
  }

  # Main pages — short cache
  default_cache_behavior {
    target_origin_id = "alb-origin"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
    cached_methods = ["GET", "HEAD"]
    compress = true
    cache_policy_id = aws_cloudfront_cache_policy.pages.id
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn = aws_acm_certificate.main.arn
    ssl_support_method = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }
}

# Cache Policy for static assets
resource "aws_cloudfront_cache_policy" "assets" {
  name = "assets-immutable"
  min_ttl = 31536000
  max_ttl = 31536000
  default_ttl = 31536000
  parameters_in_cache_key_and_forwarded_to_origin {
    cookies_config {
      cookie_behavior = "none"
    }
    headers_config {
      header_behavior = "none"
    }
    query_strings_config {
      query_string_behavior = "none"
    }
    enable_accept_encoding_brotli = true
    enable_accept_encoding_gzip = true
  }
}

Cache Invalidation During Deployment

# AWS CLI: invalidate everything
aws cloudfront create-invalidation \
  --distribution-id $DISTRIBUTION_ID \
  --paths "/*"

# Only HTML pages (after content publishing)
aws cloudfront create-invalidation \
  --distribution-id $DISTRIBUTION_ID \
  --paths "/blog/*" "/products/*" "/"

// Laravel: invalidation when an article is published
use Aws\CloudFront\CloudFrontClient;

class ArticlePublished
{
    public function handle(Article $article): void
    {
        $client = new CloudFrontClient([
            'version' => 'latest',
            'region' => 'us-east-1',
        ]);

        $client->createInvalidation([
            'DistributionId' => config('services.cloudfront.distribution_id'),
            'InvalidationBatch' => [
                'Paths' => ['Quantity' => 1, 'Items' => ["/blog/{$article->slug}"]],
                'CallerReference' => (string) now()->timestamp,
            ],
        ]);
    }
}

CloudFront Functions — Edge Security

// function.js — adds security headers (< 1 ms)
function handler(event) {
    var response = event.response;
    var headers = response.headers;
    headers['strict-transport-security'] = { value: 'max-age=63072000; includeSubDomains; preload' };
    headers['x-content-type-options'] = { value: 'nosniff' };
    headers['x-frame-options'] = { value: 'SAMEORIGIN' };
    headers['referrer-policy'] = { value: 'strict-origin-when-cross-origin' };
    return response;
}

resource "aws_cloudfront_function" "security_headers" {
  name    = "security-headers"
  runtime = "cloudfront-js-2.0"
  code    = file("function.js")
  publish = true
}

Origin Shield

An additional intermediate cache between edge nodes and the origin server. Reduces origin load by 10–50× for popular content. Enabled in the example above.

Timelines and Cost

Basic setup takes 1–2 days. Complex scenarios with Lambda@Edge and Origin Shield up to 5 days. We calculate the exact cost after analyzing your infrastructure. We'll evaluate your project in one day—contact us to get a proposal. Get a consultation on CloudFront setup today.

For more information: CloudFront Documentation, CDN