Route 53 and CloudFront

7 pages · ~5 min✓ Reviewed

Builds on Load Balancing and Auto Scaling. Next up: Lambda and Serverless.

AWSPage 1

Route 53 Mental Model: Zones and Records

1. Zones and Records

Hosted zone = container of records for one domain
Public: answers internet queries
Private: answers only from associated VPCs
New zone gives 4 NS records; they must match the registrar's name servers

Record = name + type + value + TTL	Meaning
`A`	IPv4 address
`AAAA`	IPv6 address
`CNAME`	name to another name
`MX`	mail
`TXT`	verification text
`NS`	delegates a subdomain

2. CNAME vs Alias

	CNAME	Alias
Zone apex (example.com)	not allowed	works
Query cost	billed	free for AWS targets
Returns	another name	A/AAAA directly

Targets: CloudFront, ALB/NLB, API Gateway, S3 website endpoint
Also Elastic Beanstalk, or another record in the same zone
An alias cannot point to an EC2 DNS name

3. Example and Mistake

example.comA alias, no TTL to set
d111abcdef8.cloudfront.netinherits target's TTL

Zone recreated?

Update the registrar NS to the new hosted zone's NS. Stale NS means DNS resolves nowhere

AWSPage 2

Routing Policies and Health Checks

1. Simple, Weighted, Latency

Policy	Answers with	Key fact
Simple	one or more values, random order	no health checks on it
Weighted	share = weight / sum of weights	weight `0` stops traffic
Latency	region with lowest latency	record tagged with a region

Weighted records share a name; weights 0-255
Weighted fits canary and blue-green
Latency is measured from the user to AWS regions, not to your server

2. Failover

Active-passive: one primary, one secondary record
The primary needs a health check

3. Geolocation and Geoproximity

AWSPage 3

Health Checks and Everyday Route 53 Usage

1. Health check types

Type	Watches	Use
Endpoint	HTTP, HTTPS or TCP target	public endpoints
Calculated	other health checks	combine with AND/OR
CloudWatch alarm	an alarm state	private resources

Interval 30s by default, 10s fast
Unhealthy after 3 failed checks by default
Checkers sit outside your VPC: private endpoint needs an alarm check
Public endpoint: allow the Route 53 health checker IP ranges in the security group

2. Everyday commands

Create or update a record: UPSERT inside change.json

bash

aws route53 change-resource-record-sets \
  --hosted-zone-id Z123 \
  --change-batch file://change.json

Check an answer with dig, or ask Route 53 itself

AWSPage 4

CloudFront Distributions, Origins and Cache Behaviours

1. Distribution and Origins

Viewerrequest
Edge locationhit: serve
Regional edge cacheedge miss
Origincache miss

Distribution = CDN config with a *.cloudfront.net domain
Origins: S3 bucket, ALB, API Gateway, any custom HTTP server
Origin group = failover to a secondary origin on 5xx or 4xx

2. Behaviours and Cache Key

Behaviour matches a path pattern: /images/*, /api/*
Picks origin, allowed methods, cache policy, viewer protocol policy (redirect HTTP to HTTPS)
Patterns are checked in order; Default (*) is last

Cache key = path + forwarded headers, cookies, query strings
More forwarded values = lower hit ratio
Forward only what the origin needs

Policy	Forwarded to origin	In cache key
Cache policy	yes

AWSPage 5

TTLs, Invalidations and OAC for S3

1. TTL and Invalidation

Origin max-age or s-maxage is honoured, clamped to policy Minimum TTL and Maximum TTL
No cache header from origin: Default TTL 86400s
Invalidation removes the object from every edge; takes minutes
First 1,000 paths/month free

bash

aws cloudfront create-invalidation \
  --distribution-id E123 \
  --paths "/index.html" "/img/*"

Better than invalidating

Versioned names (app.v3.js or a content hash) are a new URL: no invalidation, long TTLs are safe.

2. OAC for a Private S3 Bucket

OAC signs requests to S3 with SigV4; bucket stays public-blocked
Replaces legacy OAI; supports SSE-KMS and all regions

Bucket policy	Value
Principal	`cloudfront.amazonaws.com`
Action	`s3:GetObject`
Condition	`StringEquals` `AWS:SourceArn` = distribution ARN

AWSPage 6

Route 53 and CloudFront Cheat Sheet

1. Route 53 records and policies

Record	Use
`A`	IPv4
`AAAA`	IPv6
`CNAME`	name to name, not at apex
Alias	free, works at apex, AWS targets

Policy	Key fact
Simple	no health check
Weighted	weight 0-255
Latency	region based
Failover	primary + secondary + health check
Geolocation	needs a Default record

2. Health checks

Interval 30s (fast 10s)
Unhealthy after 3 failures
Private resource: use a CloudWatch alarm check

AWSPage 7

Check yourself

A teammate creates example.com as a CNAME to d111abcdef8.cloudfront.net. What goes wrong, and what is the fix?

A CNAME is not allowed at the zone apex.
Use an A alias record to the distribution. It is free and works at the apex.

Weighted records: A=200, B=50, C=0. What share of answers does each get?

A 80%, B 20%, C 0%, because share is weight / sum (250).
Weight 0 stops traffic to that record.

A private bucket uses OAC, but the origin is the S3 website endpoint. What happens?

Requests fail with 403, because the website endpoint does not support OAC.
Use the REST endpoint origin, with a bucket policy on AWS:SourceArn.