CloudFront
- Without CDN, ways to scale include
- Increasing size or number of servers
- Configure DDoDS protection, WAF, etc.
- Content delivery networks (CDNs) act as proxy, receiving requests and only forwarding to origin if necessary
- Create origin access identity to ensure only CloudFront can access S3 bucket, can keep bucket private
- Restrict viewer access
- Signed URLs and cookies: restrict access to specific pages/files with expiration
- Generated by trusted signers in your AWS account
- Field-level encryption
- CloudFront encrypts PII or other fields prior to forwarding to origin
- Steps
- App sends POST with sensitive data
- FLE intercepts POST, encrypts data with public key, forwards to origin
- Origin stores in database
- Admin uses Lambda function to retrieve and decrypt data using private key
