CloudFront and S3 architecture

1. Follow a cache miss

A viewer requests an image that is not currently cached at the serving edge.

Where does CloudFront obtain it?

From the configured origin.

A distribution points to an origin. Edge caches can store eligible responses for subsequent requests.

The miss travels to the origin; a later eligible hit can be served at the edge.

Viewer → edge miss → origin
Later request → eligible edge cache hit

2. Keep the origin private

You want viewers to use CloudFront while keeping direct public S3 access blocked.

Which design fits?

Origin Access Control plus a suitably scoped bucket policy.

For a regular S3 origin, use CloudFront origin access controls and restrict the bucket policy. Website endpoints are a different origin type.

CloudFront gets the required origin permission without making the bucket public.

Regular S3 origin + Origin Access Control
Bucket policy scoped to the distribution

3. Repair stale content

You replaced logo.png, but some viewers still receive a cached version.

Which strategy gives new releases a distinct cache key?

Use versioned asset names, such as logo.v2.png.

Caches can retain eligible content until expiration. Versioned names avoid reusing the old asset key; invalidation is another tool.

The next release references a new asset path.

Release 1: /assets/logo.v1.png
Release 2: /assets/logo.v2.png

Practice, then check your understanding

In the interactive tour, make each decision before seeing the outcome. Wrong answers receive coaching, and replay gives you a fresh attempt without duplicating earned XP.

Read the official AWS documentation for service behavior and production details.