CloudFront Cache Behaviors, Path Patterns, and Origin Access Control – SAP-C02 Study Guide

Purpose of This Lesson

CloudFront can use multiple origins within one distribution and route requests to different origins according to URL path patterns. This design is useful when a static website, images, documents, APIs, or other content types are stored in separate locations.

This lesson demonstrates a distribution with:

• A static website as the default origin.
• A separate S3 bucket for .jpg objects.
• A separate S3 bucket for .pdf objects.
• Cache behaviors that route requests based on the requested path.
• Origin Access Control (OAC) to restrict private S3 origins to CloudFront.

The important architectural ideas are origin selection, path-pattern precedence, caching behavior, and the difference between an S3 website endpoint and an S3 bucket origin.

Key Concepts

CloudFront distributions can have multiple origins

An origin is the backend location from which CloudFront retrieves content. A distribution can use multiple origins, including:

• Amazon S3 buckets
• S3 static website endpoints
• Application Load Balancers
• API Gateway endpoints
• EC2-based web servers
• Custom HTTP origins

Each cache behavior specifies which origin should receive matching requests. In the example design:

Request path	Selected origin	Purpose
/image.jpg	JPEG S3 bucket	Image content
/report.pdf	PDF S3 bucket	Document content
Any other path	Static website origin	Default site content

CloudFront is routing the request to the matching origin; it is not performing an HTTP redirect to another URL.

Default cache behavior

Every distribution has a default cache behavior. It normally uses the default origin and matches requests that do not match a more specific path pattern.

In this design, the static website is the default origin. Requests that do not end in .jpg or .pdf are sent to that origin.

The default behavior can also define settings such as:

• Allowed and cached HTTP methods
• Viewer protocol policy
• Cache policy
• Origin request policy
• Response headers policy
• Compression
• Function or Lambda@Edge associations

Path patterns select cache behaviors

Additional cache behaviors use path patterns such as:

• /*.jpg
• /*.pdf

The wildcard matches the relevant portion of the request path. A request for /assets/coffee.jpg can match /*.jpg, while /documents/report.pdf can match /*.pdf.

When multiple patterns could match, CloudFront evaluates cache behaviors in order of precedence. More specific patterns should be placed before broader patterns. The default behavior is evaluated last because it matches everything not handled by another behavior.

Path-pattern matching is not a substitute for application authorization. A user who knows an object path may still request it unless the origin and application enforce appropriate access controls.

S3 website endpoint versus S3 bucket origin

These are different types of CloudFront origins:

#### S3 static website endpoint

An S3 website endpoint supports website behavior such as:

• Index document handling
• Website-style error responses
• Website endpoint semantics

It uses HTTP rather than HTTPS between CloudFront and the S3 website endpoint. Because it is a website endpoint, it generally requires the content to be publicly readable. S3 OAC cannot be used with an S3 website endpoint.

#### S3 bucket origin

An S3 bucket origin uses the S3 service endpoint rather than the website endpoint. This is the preferred model for private content delivered through CloudFront. CloudFront can authenticate to S3 using OAC, allowing the bucket to remain private.

If website features are required while keeping the bucket private, a common alternative is to use a private S3 bucket as the origin and configure CloudFront error responses or application logic for index-document behavior. Another option is to use a different origin, such as an application or static hosting service, that provides the required website behavior.

Origin Access Control

OAC allows CloudFront to sign requests to supported AWS origins, especially private S3 buckets. The S3 bucket policy grants access to the CloudFront service principal only for the specific distribution.

A typical policy concept includes:

• Principal: cloudfront.amazonaws.com
• Action: s3:GetObject
• Resource: the bucket’s object ARN, such as arn:aws:s3:::example-bucket/*
• Condition: the AWS:SourceArn matches the intended CloudFront distribution ARN

The bucket should not rely on public access when OAC is being used. Keep S3 Block Public Access enabled for private origins and ensure the bucket policy does not grant broad public s3:GetObject access.

One OAC can generally be associated with multiple origins. The OAC is an access-control configuration, not a bucket-specific credential. The bucket policy remains responsible for granting access to each bucket.

Cache policies and disabling caching

CloudFront cache behavior settings determine whether and how responses are cached. A managed policy such as CachingOptimized is appropriate for many static assets, but caching may be disabled temporarily for testing or rapidly changing content.

Disabling caching is useful when validating routing or content updates because CloudFront retrieves content from the origin more frequently. However, it removes much of CloudFront’s performance and origin-load reduction benefit.

For production systems, prefer an intentional cache strategy:

• Use long TTLs for versioned, immutable assets.
• Use shorter TTLs for content that changes frequently.
• Use invalidations for urgent removal or replacement of cached objects.
• Consider cache keys carefully so unnecessary query strings, headers, or cookies do not fragment the cache.

Changing or deleting an object in S3 does not necessarily make an already cached CloudFront response disappear immediately. Use a cache invalidation or wait for the object to expire.

Distribution lifecycle and deletion

CloudFront distributions are global resources and configuration changes can take time to deploy. A distribution cannot be deleted while it is enabled. The operational sequence is:

1. Disable the distribution.
2. Wait for the disabled state to propagate.
3. Delete the distribution.

This delay is expected and should be included in cleanup procedures and automation plans.

Exam-Relevant Takeaways

• Use multiple CloudFront origins when different content classes or applications have different storage, security, or caching requirements.
• Use cache behaviors to route requests by URL path pattern.
• The default cache behavior handles requests that do not match another behavior.
• Configure path behaviors in the correct precedence order, especially when patterns overlap.
• Use an S3 website endpoint when S3 website hosting semantics are required, but remember that OAC does not protect a website endpoint.
• Use an S3 bucket origin with OAC for private S3 content delivered through CloudFront.
• OAC is implemented with a CloudFront service-principal bucket policy and a distribution-specific AWS:SourceArn condition.
• A CloudFront distribution can use one OAC for multiple S3 origins, but each bucket still needs an appropriate bucket policy.
• Disabling caching can help during testing, but it is not normally a production performance strategy.
• Cached objects may remain available after the origin object changes until TTL expiration or invalidation.
• CloudFront distributions must be disabled before they can be deleted.

Architecture Decision Guide

Requirement	Recommended design	Important consideration
Serve a public static website with S3 website behavior	CloudFront with an S3 website endpoint	Website endpoint requires HTTP to the origin and cannot use OAC
Serve private S3 objects through CloudFront	S3 bucket origin with OAC	Keep the bucket private and scope the bucket policy to the distribution
Route images and documents to different storage locations	Separate origins and path-based cache behaviors	Check behavior precedence and path-pattern coverage
Test routing while content changes frequently	Temporarily disable caching or use very short TTLs	This increases origin requests and reduces CloudFront benefits
Update immutable assets without invalidation	Use versioned object names, such as app-2026-09.js	Update references to the new version
Remove a cached object urgently	Create a CloudFront invalidation	Invalidations can have cost and operational implications at scale
Support an index document from a private S3 origin	Use CloudFront configuration or an application/origin that implements the behavior	S3 website endpoint behavior is not available through private OAC access

Common Exam Traps

• Confusing routing with redirection: A cache behavior sends the request to a selected origin. It does not change the browser’s URL or issue an HTTP redirect.
• Using OAC with an S3 website endpoint: OAC applies to supported S3 bucket origins, not S3 website endpoints.
• Making an OAC-protected bucket public: Public access defeats the purpose of OAC and violates a common private-content requirement.
• Forgetting the object wildcard in the S3 policy: The resource must normally reference objects, for example arn:aws:s3:::bucket-name/*, rather than only the bucket ARN.
• Ignoring behavior precedence: Overlapping path patterns can route requests unexpectedly if the more specific behavior is not evaluated first.
• Assuming S3 changes are immediately visible: CloudFront may continue serving a cached response until expiration or invalidation.
• Treating disabled caching as a permanent optimization: It improves freshness at the expense of latency, origin load, and transfer efficiency.
• Expecting immediate distribution deletion: CloudFront must first be disabled, and the state change can take time to propagate.
• Assuming the default behavior is optional: Every distribution needs a default behavior for requests that do not match additional patterns.

Real-World Engineer Notes

• Prefer separate behaviors for content with genuinely different security or caching requirements, not merely because file extensions differ.
• A file-extension pattern such as /*.jpg may not cover every desired path convention. Define patterns around the actual URL structure used by the application.
• Treat path patterns as routing rules, not authorization rules. Use signed URLs, signed cookies, application authorization, or private origins when access must be restricted.
• Use OAC rather than the older Origin Access Identity approach for new S3 integrations unless a legacy constraint requires otherwise.
• Scope S3 bucket policies to a specific distribution using AWS:SourceArn and, where appropriate, the relevant account conditions.
• When using OAC, make sure CloudFront signing is configured consistently and that the S3 bucket policy allows the required signed request behavior.
• Version static assets to avoid frequent invalidations. Reserve invalidations for urgent changes or objects that cannot be versioned.
• CloudFront configuration changes are asynchronous. Build deployment and rollback workflows that wait for distribution status rather than assuming immediate consistency.
• For production websites, HTTPS is normally enforced for viewers even when a legacy S3 website endpoint uses HTTP as its origin connection.

Quick Reference Summary

• Origin: Backend source of CloudFront content.
• Default origin: Used by the default cache behavior.
• Cache behavior: Associates a path pattern with an origin and request/caching settings.
• Path pattern: Determines which behavior handles a request, such as /*.jpg.
• OAC: Lets CloudFront access private S3 bucket origins using authenticated requests.
• S3 website endpoint: Supports website hosting semantics but is not compatible with OAC.
• Cache invalidation: Removes selected cached objects before their normal TTL expiration.
• Distribution deletion: Disable first, then delete after the disabled state is reached.

Flashcards

1. Q: What is the purpose of a CloudFront cache behavior?

A: It defines how requests matching a path pattern are handled, including the selected origin, caching, methods, and protocol policies.

1. Q: What happens to a request that matches no additional cache behavior?

A: It is handled by the default cache behavior and sent to the default origin.

1. Q: Does a path-based CloudFront behavior redirect the client?

A: No. It routes the request internally to a selected origin without changing the client URL.

1. Q: Which CloudFront origin type supports S3 website hosting behavior?

A: An S3 static website endpoint.

1. Q: Can OAC be used with an S3 website endpoint?

A: No. OAC is used with an S3 bucket origin, not the website endpoint.

1. Q: What is the preferred approach for private S3 content behind CloudFront?

A: Use an S3 bucket origin with Origin Access Control and a restrictive S3 bucket policy.

1. Q: What principal commonly appears in an OAC-based S3 bucket policy?

A: The CloudFront service principal, cloudfront.amazonaws.com.

1. Q: Why should an OAC S3 policy use AWS:SourceArn?

A: To restrict access to requests originating from the intended CloudFront distribution.

1. Q: What does disabling CloudFront caching accomplish?

A: It causes CloudFront to retrieve content from the origin rather than serving cached responses, which is useful for testing but reduces performance benefits.

1. Q: How can a changed object be served immediately when it is already cached?

A: Create a CloudFront invalidation or use a new versioned object name.

1. Q: Can one OAC be used with multiple S3 origins?

A: Yes, provided each S3 bucket has a suitable bucket policy.

1. Q: What must happen before deleting a CloudFront distribution?

A: The distribution must be disabled and reach the disabled state.

Practice Questions

Question 1

A company stores public website files in one S3 location, JPEG images in a second bucket, and PDF reports in a third bucket. It wants one CloudFront domain name, with requests ending in .jpg sent to the image bucket and requests ending in .pdf sent to the report bucket. All other requests should display the website. Which design meets the requirement?

A. Create three CloudFront distributions and configure DNS weighted routing.
B. Create one distribution with three origins, two path-based cache behaviors, and a default behavior for the website.
C. Configure S3 event notifications to copy objects into a single bucket.
D. Use an S3 bucket policy to redirect requests based on file extension.

Correct answer: B

Explanation: A single CloudFront distribution can contain multiple origins and cache behaviors. The .jpg and .pdf behaviors route matching requests to their respective origins, while the default behavior handles everything else.

Question 2

An organization requires private S3 objects to be delivered through CloudFront. The S3 bucket must not be publicly readable. Which configuration should an architect recommend?

A. Use an S3 website endpoint and enable public read access.
B. Use an S3 bucket origin, configure OAC, and allow the CloudFront service principal in the bucket policy.
C. Use an S3 website endpoint and attach an OAC to it.
D. Disable S3 Block Public Access and rely on an unlisted object URL.

Correct answer: B

Explanation: A private S3 bucket origin can use OAC. The bucket policy grants s3:GetObject to CloudFront and can restrict access using the distribution’s AWS:SourceArn. Website endpoints do not support OAC.

Question 3

An engineer replaces an object in S3, but users continue to receive the previous version through CloudFront. The business requires the new version to be available immediately. What should the engineer do?

A. Disable and recreate the S3 bucket.
B. Change the S3 bucket Region.
C. Create a CloudFront invalidation for the affected object, or deploy it under a new versioned key.
D. Add another default cache behavior.

Correct answer: C

Explanation: CloudFront may serve a cached response until its TTL expires. An invalidation removes selected cached objects, while versioned object names avoid ambiguity and are often preferable for static assets.

Question 4

A CloudFront distribution has these behaviors:

• /* routes to an application origin.
• /images/* routes to an S3 image origin.

Requests for /images/logo.png are being sent to the application origin. What is the most likely issue?

A. The S3 bucket must have a website endpoint.
B. CloudFront cannot route requests to S3.
C. The broad /* behavior is taking precedence over the image behavior.
D. OAC prevents path-based routing.

Correct answer: C

Explanation: Overlapping path patterns must be ordered so that the intended specific behavior is evaluated before the broad catch-all pattern. The image behavior should take precedence over /*.

Question 5

A team uses an S3 website endpoint as the CloudFront origin because it needs S3 index-document behavior. It also wants the bucket to remain private using OAC. What should the architect explain?

A. OAC automatically converts the website endpoint to a private origin.
B. OAC works only with S3 website endpoints in the same Region.
C. The requirements conflict because OAC is not supported with S3 website endpoints.
D. The bucket can remain private if the CloudFront distribution disables caching.

Correct answer: C

Explanation: S3 website endpoints and private S3 bucket origins are different integration models. OAC is supported with the bucket origin, not the website endpoint. The architect must redesign the website behavior or use an origin that supports both the required routing and private access model.