AWS DNS, Caching, and Performance Optimization Architecture Patterns – SAP-C02 Study Guide

Purpose of This Lesson

This lesson focuses on selecting AWS DNS, content delivery, and traffic-routing patterns for common architecture requirements. The key decisions involve choosing the correct Route 53 record and routing policy, directing CloudFront requests to the appropriate origin, controlling access to cached content, and improving multi-Region application availability and performance.

Key Concepts

Route 53 Alias Records for AWS Resources

An Elastic Load Balancer must be reachable through a company-owned public domain name. When the domain is hosted in a Route 53 public hosted zone, create an alias record that points to the load balancer.

Alias records are AWS-specific extensions to DNS. They can point a record at supported AWS resources, including:

• Application Load Balancers
• Network Load Balancers
• CloudFront distributions
• API Gateway APIs
• S3 website endpoints
• Another Route 53 record in some configurations

An alias record is particularly important when the name being configured is the zone apex, such as example.com. Standard DNS does not allow a CNAME at the apex. A CNAME can be used for a subdomain such as www.example.com, but an alias record is the normal Route 53 choice for an AWS resource and supports the zone apex.

Route 53 Failover Routing

Failover routing is designed for an active-passive architecture:

• A primary record receives normal traffic.
• A secondary record receives traffic when the primary is considered unhealthy.
• A Route 53 health check determines whether the primary endpoint is available.

This pattern does not distribute traffic across Regions under normal conditions. It keeps traffic directed to the preferred Region and uses the second Region only during an outage or failed health check.

Health checks should validate meaningful application availability where possible. A network endpoint responding on a port does not necessarily prove that the application is functioning correctly.

Geolocation Routing

Route 53 geolocation routing selects records based on the geographic location associated with the DNS query. It is useful when traffic must be handled differently according to country, continent, or other supported geographic boundaries.

Typical use cases include:

• Enforcing content distribution or licensing restrictions
• Sending users in particular countries to a regional endpoint
• Providing localized application responses
• Returning a denial or alternate endpoint for unsupported locations

Geolocation routing is based on the location of the DNS resolver or client as determined by Route 53, so it should not be treated as a perfect legal or security control for determining a user’s physical location. A default record is also important so that unmatched locations have a defined response.

CloudFront Behaviors and Multiple Origins

A CloudFront distribution can have multiple origins, such as S3 buckets in different Regions or a combination of S3 and custom HTTP origins. Cache behaviors determine which origin handles a request based on a path pattern.

Examples:

• /images/* routes to an image bucket
• /videos/* routes to a media origin
• /api/* routes to an application load balancer
• The default behavior handles all other paths

CloudFront does not automatically select an origin based on the file extension. To route by file type, define path patterns that match the relevant paths, such as /assets/*.js or /documents/*.pdf, subject to CloudFront path-pattern rules. Behaviors also control caching settings, allowed HTTP methods, viewer protocol policy, and other request-processing options.

CloudFront Signed Cookies

Signed cookies provide access control for multiple restricted files delivered through CloudFront. The application authenticates the user, then issues a signed cookie containing the policy and signature information required by CloudFront.

Signed cookies are appropriate when:

• A user needs access to many files
• File URLs should remain unchanged
• Access applies to a collection of objects or a path
• The client is a browser-based application

Signed URLs are often a better fit when granting access to one object or a small number of individually identified objects. In either case, CloudFront validates the signature before serving the protected content. The origin should also be protected so users cannot bypass CloudFront and access the files directly.

AWS Global Accelerator for Multi-Region Applications

AWS Global Accelerator provides static anycast IP addresses and routes users through the AWS global network to healthy regional endpoints. For an application deployed behind Application Load Balancers in multiple Regions, Global Accelerator can provide:

• Health-based failover
• Traffic distribution across Regional endpoints
• Improved path performance compared with relying solely on public internet routing
• Stable client-facing IP addresses
• Traffic dials and endpoint weights for controlled distribution, depending on the configuration

Global Accelerator is different from Route 53 latency-based routing. Route 53 makes a DNS response decision, while Global Accelerator receives traffic at the AWS edge and forwards it to a healthy endpoint. Global Accelerator is generally a stronger fit when the requirement emphasizes rapid failover, static IP addresses, or network-level traffic steering to regional ALBs.

Exam-Relevant Takeaways

• Use a Route 53 alias record to map a public name to an ELB, especially when the name is the zone apex.
• A CNAME is valid for a subdomain but cannot be used at the DNS zone apex.
• Use failover routing when one Region is primary and another is used only if the primary becomes unhealthy.
• Use geolocation routing when the response must vary according to the requester’s geographic location or content distribution rules.
• Use CloudFront cache behaviors and path patterns to route different URL paths to different origins.
• Use signed cookies to authorize access to multiple CloudFront objects without changing every object URL.
• Use signed URLs for access to individual objects or a small number of specifically identified resources.
• Use Global Accelerator to route traffic between Regional ALBs using health checks and the AWS global network.
• Route 53 routing decisions occur through DNS responses; Global Accelerator routes established network traffic through anycast edge entry points.

Architecture Decision Guide

Requirement	Preferred AWS capability	Reason
Map example.com to an ALB or NLB	Route 53 alias record	Supports AWS resources and the zone apex
Map app.example.com to an AWS resource	Route 53 alias record, or CNAME where appropriate	Alias is AWS-aware and avoids common CNAME limitations
Keep all traffic in one Region unless it fails	Route 53 failover routing with health checks	Implements active-passive DNS failover
Return different endpoints by country	Route 53 geolocation routing	Selects records based on geographic location
Route /images/* and /api/* to different CloudFront origins	CloudFront cache behaviors	Path patterns select the origin and request policy
Allow a user to download many protected files	CloudFront signed cookies	One authorization mechanism can cover multiple files
Grant temporary access to one protected object	CloudFront signed URL	Suited to object-specific authorization
Route users to healthy ALBs in multiple Regions	AWS Global Accelerator	Provides health-based regional endpoint routing and static anycast IPs

Common Exam Traps

• Using a CNAME at the zone apex: example.com cannot normally be configured as a CNAME. Use a Route 53 alias record for supported AWS targets.
• Confusing failover with active-active routing: Failover routing sends traffic to the secondary only when the primary is unhealthy. It is not intended to balance normal traffic between Regions.
• Using geolocation for latency optimization: Geolocation is based on geographic rules and is useful for regulatory or content policies. Latency-based routing is a different Route 53 policy.
• Assuming CloudFront chooses an origin automatically by file type: You must configure explicit cache behaviors and path patterns.
• Using signed URLs for a large content collection by default: Signed cookies are usually more convenient when a user needs access to multiple files.
• Treating CloudFront authorization as origin protection: Restrict direct access to the origin as well; otherwise, users may bypass CloudFront controls.
• Selecting Route 53 when static IPs are required: Route 53 changes DNS answers, while Global Accelerator provides static anycast IP addresses.
• Assuming Global Accelerator is a cache: Global Accelerator improves network routing and endpoint availability; it does not replace CloudFront’s content caching function.

Real-World Engineer Notes

• Define a clear default CloudFront behavior. Requests that do not match a more specific path pattern use the default behavior.
• For failover architectures, monitor an application health endpoint rather than only checking whether a load balancer port is reachable.
• Test DNS failover behavior with realistic TTLs and client-side DNS caching. DNS changes are not instantaneous for every resolver.
• Geolocation routing should complement, not replace, application authorization and contractual enforcement. DNS-based location decisions can be imperfect.
• If CloudFront uses private S3 content, use Origin Access Control where supported and keep the bucket from being publicly readable.
• When using Global Accelerator, validate endpoint health checks, traffic weights, and Regional capacity before an incident occurs.
• Choose CloudFront when the main requirement is edge caching and content delivery. Choose Global Accelerator when the main requirement is fast, health-aware network routing to dynamic regional endpoints.

Quick Reference Summary

• Alias record: Route 53 mapping to supported AWS resources; works at the zone apex.
• Failover routing: Primary/secondary DNS routing controlled by health checks.
• Geolocation routing: DNS responses vary by geographic location.
• CloudFront behavior: Path-based rule that selects an origin and request-handling settings.
• Signed cookie: Controls access to multiple CloudFront files.
• Signed URL: Controls access to a specific CloudFront object or limited set of objects.
• Global Accelerator: Anycast entry points and health-aware routing to regional endpoints.

Flashcards

1. Q: What Route 53 record should map a zone apex to an ALB?

A: An alias record.

1. Q: Why is a CNAME unsuitable for example.com at the zone apex?

A: Standard DNS does not permit a CNAME at the apex because the zone must also contain required authoritative records.

1. Q: Which Route 53 policy keeps traffic on a primary endpoint until it fails?

A: Failover routing.

1. Q: Which Route 53 policy supports country-based endpoint selection?

A: Geolocation routing.

1. Q: How does CloudFront route requests to different origins?

A: Cache behaviors use path patterns to select an origin and related request settings.

1. Q: When are signed cookies preferable to signed URLs?

A: When a client needs access to multiple protected files or a path-based collection.

1. Q: What AWS service provides static anycast IPs for multi-Region applications?

A: AWS Global Accelerator.

1. Q: Does Global Accelerator cache content?

A: No. It optimizes network entry and routing to healthy endpoints; CloudFront provides content caching.

1. Q: What is the main distinction between Route 53 and Global Accelerator traffic steering?

A: Route 53 returns DNS answers, while Global Accelerator routes traffic through AWS edge entry points to regional endpoints.

1. Q: What should be configured to prevent users from bypassing CloudFront authorization?

A: Restrict direct origin access, such as by using CloudFront Origin Access Control for supported S3 origins.

Practice Questions

Question 1

A company hosts an application behind an Application Load Balancer. Its public hosted zone is in Route 53, and the application must be reachable at example.com. Which configuration is appropriate?

A. Create a CNAME record at example.com pointing to the ALB
B. Create an A alias record at example.com pointing to the ALB
C. Create an MX record pointing to the ALB
D. Create a TXT record containing the ALB DNS name

Correct answer: B

Explanation: Route 53 alias records can point to supported AWS resources and can be used at the zone apex. A CNAME cannot be used at the apex.

Question 2

An application is deployed in two Regions. The business requires all users to access the primary Region during normal operations and to use the secondary Region only when the primary application is unavailable. Which solution best meets the requirement?

A. Route 53 weighted routing with equal weights
B. Route 53 latency-based routing without health checks
C. Route 53 failover routing with a health check on the primary endpoint
D. CloudFront with two origins and round-robin routing

Correct answer: C

Explanation: Failover routing implements active-passive behavior. The health check allows Route 53 to return the secondary endpoint when the primary is unhealthy.

Question 3

A media company must serve content only to users in countries where it has distribution rights. Different countries must receive different endpoints. Which service capability should the architect evaluate first?

A. Route 53 geolocation routing
B. Route 53 failover routing
C. CloudFront signed cookies
D. Global Accelerator endpoint weights

Correct answer: A

Explanation: Route 53 geolocation routing returns records based on geographic location and is suited to country- or region-specific endpoint selection. Application-level controls may still be required for stronger enforcement.

Question 4

A CloudFront distribution serves content from multiple S3 buckets. JavaScript files must be served from one bucket, images from another, and all other content from a default bucket. What should the architect configure?

A. Separate Route 53 hosted zones for each file type
B. CloudFront cache behaviors with path patterns and designated origins
C. One signed URL for the entire distribution
D. A Global Accelerator listener for each file type

Correct answer: B

Explanation: CloudFront cache behaviors match request paths and select the corresponding origin. The default behavior handles requests that do not match a more specific pattern.

Question 5

A global application runs behind ALBs in three Regions. It requires static client-facing IP addresses, health-based failover, and routing through the AWS global network. Which service is the best fit?

A. Route 53 geolocation routing
B. CloudFront signed cookies
C. AWS Global Accelerator
D. Route 53 simple routing

Correct answer: C

Explanation: Global Accelerator provides static anycast IP addresses and routes traffic to healthy Regional endpoints through the AWS global network. It is designed for network-level traffic acceleration and failover, not content caching.