CloudFront: Living on the Edge Stephen J. Butler Technology Services, Lead Software Developer

Overview AWS Global Infrastructure Technology Cache Behaviors CDN Whole Site (Simple) Whole Site (Advanced) Multi/Micro-service Errors and Invalidations Publish@Illinois Web Application Firewall (WAF)

AWS Global Infrastructure Availability Zone (AZ) One or more data centers Low latency connections Replicated data Redundant power Regions Physical geographic area Collection of AZ’s

AWS Global Infrastructure What are the blue dots?

AWS Global Infrastructure Edge Locations 50 cities vs. 16 regions; including Chicago and St. Louis Faster delivery of content Cheaper bandwidth costs (vs. regional resource) Data centers hosting CloudFront and Route53

Technology Acts like a caching or reverse proxy server Configuration Web Distribution Custom domains (CNAMEs) must be listed: example.illinois.edu HTTPS via SNI or dedicated IP ($$$) HTTP/1.0, HTTP/1.1, and HTTP/2 IPv4 and IPv6 Origins Where CloudFront gets objects from Host: origin.example.illinois.edu Protocol: HTTP, HTTPS, or Match Viewer Custom Headers (sent with every request)

Technology

Technology Price Class 100 Price Class 200 Price Class All $0.085/GB-mo US $0.140/GB-mo Canada Hong Kong South America ($0.250/GB-mo) Europe Philippines South Korea Australia ($0.140/GB-mo) Singapore Taiwan Japan India ($0.170/GB-mo)

Cache Behaviors Rules for caching each request Simple path patterns; wildcards = * and ? Cache Methods: HEAD, GET, OPTIONS (optional) Cache TTL: min, max, and default Query Strings Forward all, whitelist cached Manage updates of static assets: ver=XXX Cookies Whitelist the ones you need Cached differently for logged in users Common: PHPSESSID; JSESSIONID; wordpress_* and wp-settings-* Headers Forward all: no caching Whitelist only the ones you need (Common: Host, Origin) User-Agent: CloudFront-Is-Desktop-Viewer; CloudFront-Is-Mobile-Viewer; CloudFront-Is-Tablet-Viewer

Cache Behaviors Example Requests Path: /static/foo.jpg Default (*) Path: /static/my-app/foo.jpg static/notmy-app/* static/my-app/* Path: /static-stuff/my-app/foo.jpg

Cache Behaviors: CDN Origin: S3 bucket (cdn.example.illinois.edu.s3.amazonaws.com) Patterns: Default is probably fine Cache TTL: adjust min, max, and default to desired cache time Query Strings: None Cookies: None Headers: None

Cache Behaviors: Simple Origin: origin.example.illinois.edu /static/* TTLs: min = 1 day; max = 1 week; default = 1 day Query String and Cookies: none Headers: Host, Origin /uploads/* TTLs: min = 1 hour; max = 1 day; default = 1 hour Query String: None Cookies: sessionid, _shibsession_* Default (*) Headers: forward all (disables caching)

Cache Behaviors: Advanced Origin: origin.example.illinois.edu /static/* Same /uploads/* Default (*) Headers: Host, Origin Use Origin Cache Headers TTLs: min = 0; max = 31536000; default = 0 Cookies: sessionid, _shibsession_* Will respond to standard Cache-Control headers

Cache Behaviors: Multi Origins cdn.example.illinois.edu.s3.amazonaws.com foo-service.example.illinois.edu bar-service.example.illinois.edu main-service.example.illinois.edu /static/* Desired cache settings Origin: cdn.example.illinois.edu.s3.amazonaws.com /foo/* Origin: foo-service.example.illinois.edu /bar/* Origin: bar-service.example.illinois.edu Default (*) Origin: main-service.example.illinois.edu

Cache Behaviors: Multi

Errors and Invalidations Error Responses (4xx and 5xx) Default TTL: 5 minutes Careful! Verify this is OK for things like "403 Forbidden" Can set custom error pages Invalidations Force objects to be invalidated from the cache List of path patterns Wildcard allowed only at the end /static/* /foo/* /bar/*

Publish@Illinois

Publish@Illinois

Web Application Firewall

Web Application Firewall HTTP Protocol Firewall Create filters based on IP, Headers, Body Centralized rules across multiple websites CloudFront, ALB

Web Application Firewall Regular Rules Patterns in the request IP Address Headers SQL Injection, XSS Rate Rules Same as regular rules Addes a rate of requests/time period API: possibilities for Splunk, Lambda, other logs analysis

Q&A Stephen J. Butler (sbutler1@illinois.edu) CloudFront Technology Services, Lead Software Developer CloudFront https://aws.amazon.com/documentation/cloudfront/ http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#request-custom-headers-behavior WAF https://aws.amazon.com/documentation/waf/ https://aws.amazon.com/blogs/security/how-to-configure-rate-based-blacklisting-with-aws-waf-and-aws-lambda/