What is Amazon CloudFront I Global Distribution
Amazon CloudFront is a content delivery network operated by Amazon Web Services. The content delivery network was created to provide a globally-distributed network of proxy servers to cache content, such as web videos or other bulky media, more locally to consumers, to improve access speed for downloading the content.
Intro:
Welcome to Day 4 of the AWS Builder Challenge 🚀!
So far, we’ve:
Create a Free Tier Account Day 1
Stored files securely in S3 (Day 2)
Built and hosted a static website (Day 3)
But here’s a challenge: your website may be fast in your city, but what happens when someone in another part of the world visits it? 🌎
Today, we’ll solve the distance + speed problem by using Amazon CloudFront, AWS’s Content Delivery Network (CDN). By the end of this guide, your website will load quickly from anywhere in the world — while keeping your S3 bucket secure. 🔒
Why Distance Matters 🌐
When someone in Nairobi visits a website hosted in N.Virginia, their request travels 24,000 km roundtrip.
That’s why:
Sites load slowly across continents
Connections feel unreliable
Visitors often leave slow websites
The solution?
A CDN.
CDNs store cached copies of your content across the globe. Visitors are served by the nearest location, not your distant origin server.
Benefits:
✅ Faster load times
✅ Higher reliability
✅ More secure
✅ Less load on your S3 bucket
Step 1: Create Your Global Distribution 🌍
In the AWS Console, search for CloudFront.
Click Create distribution.
Select your preferred name for the distribution
Keep Default Settings as 👇
press next to
Origin settings:
Origin type → select Amazon S3
On Origin Select Browse S3 then Select your S3 bucket from (Day 2)
Search its name and click choose
Keep default Setting as above 👆 but incase you see such a dialogue as below 👇 click copy policy it will be used later
and paste it(policy ) in your bucket policy under Permission tab in s3 You can open new tab and do it like this .
in Cloudfront Dashboard Leave custom domain setup for later.
Review → Create distribution.
👉 Now CloudFront will start deploying your website globally (this takes ~10–15 min).
👤 Personal Story: My “Access Denied” Lesson
When I first set up CloudFront for my S3 website, I hit the dreaded:
Access Denied
😅 At first, I thought I misconfigured permissions. After digging deeper, I realized I forgot to activate Origin Access Control (OAC) in CloudFront. Reason begin I clicked use website endpoint
if you doing this challenge don't try to do this 👆 because it change the menu in a way you will not be able to see permission to allow cloudfront acess s3 through bucket policy 👇
It was frustrating — but also a valuable lesson:
👉 CloudFront doesn’t break by accident. It breaks to keep your content secure.
Once I set up OAC with the bucket endpoint (not the static website endpoint), everything worked perfectly. ✅
but incase you made this mistake you can create new OAC 👆 you can see a button to create it
and copy policy
and paste it in your bucket policy under Permission tab in s3
So don’t worry if you see “Access Denied.” Every error is just one step closer to mastering AWS.
Step 2: Configure Your Homepage 🏡
Open your distribution → Edit settings.
Scroll to Default root object.
Enter: index.html
Save changes.
Step 3: Test Your Global Website 🧪
Wait until status = Deployed.
Copy your CloudFront domain (e.g., d12345678.cloudfront.net). see mine here
Open in browser → 🎉 Your site is live globally!
Try accessing your old S3 website link → should now return Access Denied. Reason now traffic is sent through cloudfront then S3 also I blocked public acess .
Step 4: Verify Security 🔒
Behind the scenes, CloudFront created an Origin Access Control (OAC).
This acts like a secret key 🔑:
Visitors can only access files via CloudFront
Direct S3 access is blocked
Result → Your bucket stays private + secure, while your website stays fast + global.
When I first set up CloudFront for my S3 website, I hit an “Access Denied” error. 😅
After some digging, I realized I forgot to activate the origin access inside CloudFront.
It was frustrating, but also a valuable lesson — security is baked into CloudFront for a reason.
A quick YouTube video 🎥 of that frustration 👇 actually now after doing this Challenge I finally understand this error well . And how I solved it on this video is not the correct way since I enabled block public policy instead of letting cloudfront send authenticated requests to an Amazon S3 via bucket policy for info READ More
So don’t worry if you hit errors — every “Access Denied” is just one step closer to mastering AWS. 💪
✅ To-Do Checklist
Create CloudFront distribution
Connect to private S3 bucket
Set index.html as root object
Test global domain
Verify S3 remains private
🎉 Congratulations!
You’ve just unlocked global web delivery. Your website is now:
Fast anywhere in the world 🌍
Secure with CloudFront + OAC 🔒 it has even https certificate 👆
Ready for the next step → (Day 5).