CloudFront Setup

You are an AWS cloud infrastructure engineer. The user wants to set up a CloudFront CDN distribution to cache and serve content globally with custom configurations.

What to check first

• Run aws configure to verify AWS credentials are set and region is configured
• Check that your origin (S3 bucket, load balancer, or custom domain) is accessible and note its full endpoint URL
• Verify IAM permissions include cloudfront:CreateDistribution, cloudfront:GetDistribution, and cloudfront:ListDistributions

Steps

1. Create a CloudFront distribution using the AWS CLI with aws cloudfront create-distribution and pass a distribution config JSON file specifying your origin domain name, default cache behavior, and viewer protocol policy
2. Set the OriginProtocolPolicy to https-only or http-only depending on your origin's protocol support
3. Configure the DefaultCacheBehavior with ViewerProtocolPolicy set to redirect-to-https for HTTPS enforcement
4. Add cache headers by setting MinTTL, DefaultTTL, and MaxTTL values (in seconds) in the cache behavior—use 0, 86400, and 31536000 respectively for typical web content
5. Enable Compress to automatically gzip compressible content types before serving to viewers
6. Set QueryStringCaching to false unless you need cache variance based on query parameters
7. Add custom headers or restrictions using the CustomHeaders field if your origin requires them
8. After creation, retrieve your distribution domain name (e.g., d123abc.cloudfront.net) and optionally create a CNAME record pointing your domain to this CloudFront domain
9. Monitor cache hit ratio and performance using CloudFront metrics in CloudWatch

Code

#!/bin/bash

# Create distribution config JSON
cat > distribution-config.json <<'EOF'
{
  "CallerReference": "my-distribution-$(date +%s)",
  "Comment": "CDN distribution for web application",
  "DefaultRootObject": "index.html",
  "Origins": {
    "Quantity": 1,
    "Items": [
      {
        "Id": "myOrigin",
        "DomainName": "mybucket.s3.amazonaws.com",
        "S3OriginConfig": {
          "OriginAccessIdentity": ""
        }
      }
    ]
  },
  "DefaultCacheBehavior": {
    "TargetOriginId": "myOrigin",
    "ViewerProtocolPolicy": "redirect-to-https",
    "TrustedSigners": {
      "Enabled": false,
      "Quantity": 0
    },
    "MinTTL": 0,
    "DefaultTTL": 86400,
    "MaxTTL": 31536000,
    "Compress": true,
    "ForwardedValues": {
      "Query

Note: this example was truncated in the source. See the GitHub repo for the latest full version.

Common Pitfalls

• Treating this skill as a one-shot solution — most workflows need iteration and verification
• Skipping the verification steps — you don't know it worked until you measure
• Applying this skill without understanding the underlying problem — read the related docs first

When NOT to Use This Skill

• When a simpler manual approach would take less than 10 minutes
• On critical production systems without testing in staging first
• When you don't have permission or authorization to make these changes

How to Verify It Worked

• Run the verification steps documented above
• Compare the output against your expected baseline
• Check logs for any warnings or errors — silent failures are the worst kind

Production Considerations

• Test in staging before deploying to production
• Have a rollback plan — every change should be reversible
• Monitor the affected systems for at least 24 hours after the change