DNS and CDN: Route 53 and CloudFront

Why DNS and a CDN matter

Users type a name, not an IP address. DNS (Domain Name System) is the internet's phone book that turns that name into an address. A CDN (Content Delivery Network) keeps copies of your files in many cities, so a user in Guwahati gets a video from a nearby edge server instead of from a data centre in Mumbai. Together they decide how fast, and how reliably, users reach your app.

Route 53 basics

Amazon Route 53 can register domain names and answer DNS queries. A hosted zone holds the records for one domain, such as example.com. A record maps a name to a value and has a TTL (time to live): how many seconds resolvers may cache the answer.

The zone apex is the bare domain, example.com, without www. Standard DNS does not allow a CNAME there. Route 53 alias records solve this: they work at the apex, follow the AWS resource's changing IPs automatically, and queries to AWS resources through alias records are not charged.

Routing policies and health checks

• Simple: one answer (or several values returned together).
• Weighted: split traffic by weights, for example 90 to the current version and 10 to a new one (a canary release).
• Latency: send each user to the region with the lowest latency for them.
• Failover: send traffic to the primary while its health check passes, and to a standby when it fails.
• Geolocation: answer by the user's country or continent, for example to meet data rules or show local content.
• Also available: geoproximity, multivalue answer and IP-based routing.

A health check regularly calls an endpoint, such as https://api.example.com/healthz, from several locations. Failover and other policies skip records whose health check is failing.

{
  "Changes": [
    {
      "Action": "UPSERT",
      "ResourceRecordSet": {
        "Name": "api.example.com",
        "Type": "A",
        "SetIdentifier": "v2-canary",
        "Weight": 10,
        "TTL": 60,
        "ResourceRecords": [{ "Value": "203.0.113.20" }]
      }
    }
  ]
}

CloudFront: caching at the edge

Amazon CloudFront is AWS's CDN. You create a distribution with one or more origins, the places where the real content lives: an S3 bucket (made private with Origin Access Control), an Application Load Balancer, or any HTTP server. Users connect to the nearest edge location. On a cache hit, the edge already has the file and returns it at once. On a cache miss, it fetches from the origin, returns it, and keeps a copy for next time.

How long a copy stays is controlled by TTLs in the cache policy and by Cache-Control headers from your origin. Long TTLs give more hits and lower origin load; short TTLs give fresher content. The usual trick is versioned file names (app.3f9c2a.js) with long TTLs, plus short TTLs for HTML. To remove an object early, create an invalidation.

aws cloudfront create-invalidation --distribution-id EDFDVBD6EXAMPLE --paths "/index.html" "/live/*"

HTTPS with your own domain

Use a free public certificate from AWS Certificate Manager (ACM). For CloudFront, the certificate must be requested or imported in the US East (N. Virginia) region, us-east-1, whatever region your origin is in. A load balancer in Mumbai, by contrast, needs its certificate in ap-south-1. CloudFront also integrates with AWS WAF for filtering attacks and includes AWS Shield Standard DDoS protection.