Route 53, CloudFront, ACM and caching

Why and what

Route 53 hosts authoritative DNS and supports routing policies. CloudFront distributes cached content near viewers and forwards misses to an origin. ACM manages certificates for integrated AWS services. These are different layers: DNS points clients to an endpoint; the CDN handles requests; TLS authenticates/encrypts the connection.

Private S3 origin lab

1. Upload a static test site to a private S3 bucket.
2. Create a CloudFront distribution with that bucket's REST origin, not its website endpoint.
3. Configure Origin Access Control and a bucket policy limited to the distribution.
4. Set the default root object to index.html, redirect viewer HTTP to HTTPS and deploy.
5. Test the CloudFront hostname while direct unsigned S3 access remains denied.
6. For a custom name, request/validate an ACM certificate in the Region required by CloudFront, currently US East (N. Virginia), and add the alternate domain. For a regional ALB, use a certificate in that ALB's Region.
7. Add a Route 53 alias or appropriate DNS CNAME to the distribution. Domain registration may remain at GoDaddy while authoritative DNS moves to Route 53.

Cache correctness

A cache key determines which requests can share a response. Forwarding cookies, headers and query strings without understanding the cache policy can leak personalized content or destroy hit rates. Keep authenticated APIs uncached unless deliberately designed otherwise. Use versioned asset filenames for deployment; invalidate only paths that need immediate refresh.

Routing policies

Simple routing returns configured answers. Weighted routing supports controlled proportions, latency routing chooses based on network latency estimates, and failover routing combines primary/secondary records with health logic. DNS caching means a weight change is not an instantaneous precise per-request switch.

Verify and troubleshoot

Inspect response headers and repeat a request to observe caching behaviour. A 403 may come from origin policy, missing key or distribution configuration. DNS success with certificate failure suggests alternate-name/certificate mismatch. A private bucket policy must identify the correct distribution/account, not a guessed ARN.

Assignment

Publish versioned CSS, change the HTML reference and compare with cache invalidation. Explain why private S3 plus CloudFront can serve public assets without making the S3 bucket itself public.

Official references

CloudFront OAC Route 53 guide

Interview and revision check

Why should personalized responses not use a shared public cache key?

Different users could receive another user's cached content. Authorization and cache-key/forwarding policy must be designed together.