Amazon CloudFront

// Khi primary origin trả về 500/502/503/504
// → CloudFront tự động chuyển sang secondary
{
  "OriginGroup": {
    "Id": "my-origin-group",
    "FailoverCriteria": {
      "StatusCodes": { "Items": [500, 502, 503, 504] }
    },
    "Members": {
      "Items": [
        { "OriginId": "primary-s3-us-east-1" },
        { "OriginId": "secondary-s3-eu-west-1" }
      ]
    }
  }
}

# Tạo custom cache policy
aws cloudfront create-cache-policy \
  --cache-policy-config '{
    "Name": "MyCustomCachePolicy",
    "DefaultTTL": 86400,
    "MinTTL": 1,
    "MaxTTL": 31536000,
    "ParametersInCacheKeyAndForwardedToOrigin": {
      "EnableAcceptEncodingGzip": true,
      "EnableAcceptEncodingBrotli": true,
      "HeadersConfig": {
        "HeaderBehavior": "whitelist",
        "Headers": { "Items": ["Accept-Language"], "Quantity": 1 }
      },
      "CookiesConfig": { "CookieBehavior": "none" },
      "QueryStringsConfig": {
        "QueryStringBehavior": "whitelist",
        "QueryStrings": { "Items": ["id", "page"], "Quantity": 2 }
      }
    }
  }'

aws cloudfront create-origin-access-control \
  --origin-access-control-config '{
    "Name": "my-s3-oac",
    "Description": "OAC for S3 bucket",
    "SigningProtocol": "sigv4",
    "SigningBehavior": "always",
    "OriginAccessControlOriginType": "s3"
  }'

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "AllowCloudFrontOAC",
    "Effect": "Allow",
    "Principal": {
      "Service": "cloudfront.amazonaws.com"
    },
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::my-bucket/*",
    "Condition": {
      "StringEquals": {
        "AWS:SourceArn": "arn:aws:cloudfront::111122223333:distribution/EDFDVBD6EXAMPLE"
      }
    }
  }]
}

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1234567890"
    },
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::my-bucket/*"
  }]
}

# Certificate cho CloudFront PHẢI ở us-east-1
aws acm request-certificate \
  --region us-east-1 \
  --domain-name cdn.example.com \
  --subject-alternative-names "*.example.com" \
  --validation-method DNS

# Sau khi validate, gán vào distribution
aws cloudfront update-distribution \
  --id E1234567890 \
  --distribution-config '{
    "ViewerCertificate": {
      "ACMCertificateArn": "arn:aws:acm:us-east-1:111122223333:certificate/abc-123",
      "SSLSupportMethod": "sni-only",
      "MinimumProtocolVersion": "TLSv1.2_2021"
    },
    "Aliases": { "Items": ["cdn.example.com"], "Quantity": 1 }
  }'

# Invalidate một file cụ thể
aws cloudfront create-invalidation \
  --distribution-id E1234567890 \
  --paths "/index.html"

# Invalidate nhiều files
aws cloudfront create-invalidation \
  --distribution-id E1234567890 \
  --paths "/images/*" "/css/*" "/js/*"

# Invalidate TẤT CẢ (wildcard)
aws cloudfront create-invalidation \
  --distribution-id E1234567890 \
  --paths "/*"

# Kiểm tra trạng thái invalidation
aws cloudfront get-invalidation \
  --distribution-id E1234567890 \
  --id I1234567890

function handler(event) {
  var request = event.request;
  var uri = request.uri;

  // Nếu URI không có extension → thêm /index.html
  if (uri.endsWith('/')) {
    request.uri += 'index.html';
  } else if (!uri.includes('.')) {
    request.uri += '/index.html';
  }

  return request;
}

'use strict';
exports.handler = async (event) => {
  const request = event.Records[0].cf.request;
  const headers = request.headers;

  // Đọc cookie để xác định variant
  const cookie = headers.cookie || [];
  const abCookie = cookie.find(c =>
    c.value.includes('X-AB-Variant=')
  );

  if (abCookie && abCookie.value.includes('B')) {
    // Route đến origin B
    request.origin.s3.domainName = 'variant-b-bucket.s3.amazonaws.com';
    request.headers['host'] = [{ value: 'variant-b-bucket.s3.amazonaws.com' }];
  }

  return request;
};

#Fields: date time x-edge-location sc-bytes c-ip cs-method cs(Host) cs-uri-stem sc-status cs(Referer) cs(User-Agent) cs-uri-query cs(Cookie) x-edge-result-type x-edge-request-id
2026-04-14  08:30:15  SIN2-C1  12345  203.0.113.50  GET  d1234.cloudfront.net  /images/logo.png  200  https://example.com/  Mozilla/5.0...  -  -  Hit  AbCdEf123==

aws cloudfront create-realtime-log-config \
  --name my-realtime-logs \
  --sampling-rate 100 \
  --fields "timestamp" "c-ip" "sc-status" "cs-uri-stem" \
           "x-edge-result-type" "time-taken" \
  --end-points '{
    "StreamType": "Kinesis",
    "KinesisStreamConfig": {
      "RoleARN": "arn:aws:iam::111122223333:role/CloudFrontRealtimeLogRole",
      "StreamARN": "arn:aws:kinesis:us-east-1:111122223333:stream/cf-realtime-logs"
    }
  }'

# Cache result
X-Cache: Hit from cloudfront        # Served từ cache
X-Cache: Miss from cloudfront       # Fetch từ origin
X-Cache: RefreshHit from cloudfront  # Cache expired, revalidated

# Edge location xử lý request
X-Amz-Cf-Pop: SIN2-C1              # Singapore edge location

# Request ID (dùng cho support ticket)
X-Amz-Cf-Id: AbCdEf123456789==

# Age (seconds object đã ở trong cache)
Age: 3600                           # Đã cache 1 giờ

# Kiểm tra bằng curl
curl -I https://cdn.example.com/index.html

# Liệt kê tất cả distributions
aws cloudfront list-distributions \
  --query "DistributionList.Items[].{Id:Id,Domain:DomainName,Status:Status,Aliases:Aliases.Items[0]}" \
  --output table

# Xem chi tiết distribution
aws cloudfront get-distribution --id E1234567890

# Xem cấu hình distribution
aws cloudfront get-distribution-config --id E1234567890

# Tạo distribution từ S3 origin (basic)
aws cloudfront create-distribution \
  --origin-domain-name my-bucket.s3.amazonaws.com \
  --default-root-object index.html

# Disable distribution (trước khi xóa)
aws cloudfront get-distribution-config --id E1234567890 --query "ETag" --output text
# Sửa Enabled: false trong config, rồi:
aws cloudfront update-distribution --id E1234567890 \
  --if-match ETAG_VALUE \
  --distribution-config file://disabled-config.json

# Xóa distribution (phải disable trước)
aws cloudfront delete-distribution --id E1234567890 --if-match ETAG_VALUE

# Invalidate file cụ thể
aws cloudfront create-invalidation \
  --distribution-id E1234567890 \
  --paths "/index.html" "/about.html"

# Invalidate tất cả files trong thư mục
aws cloudfront create-invalidation \
  --distribution-id E1234567890 \
  --paths "/images/*"

# Invalidate TẤT CẢ
aws cloudfront create-invalidation \
  --distribution-id E1234567890 \
  --paths "/*"

# Liệt kê invalidations
aws cloudfront list-invalidations --distribution-id E1234567890

# Kiểm tra trạng thái invalidation
aws cloudfront get-invalidation \
  --distribution-id E1234567890 \
  --id I1234567890

# Tạo OAC
aws cloudfront create-origin-access-control \
  --origin-access-control-config '{
    "Name": "my-s3-oac",
    "Description": "OAC for S3",
    "SigningProtocol": "sigv4",
    "SigningBehavior": "always",
    "OriginAccessControlOriginType": "s3"
  }'

# Liệt kê OACs
aws cloudfront list-origin-access-controls

# Xem chi tiết OAC
aws cloudfront get-origin-access-control --id E1234567890

# Tạo function
aws cloudfront create-function \
  --name my-url-rewrite \
  --function-config '{
    "Comment": "URL rewrite for SPA",
    "Runtime": "cloudfront-js-2.0"
  }' \
  --function-code fileb://function.js

# Test function
aws cloudfront test-function \
  --name my-url-rewrite \
  --if-match ETAG_VALUE \
  --event-object fileb://test-event.json \
  --stage DEVELOPMENT

# Publish function (DEVELOPMENT → LIVE)
aws cloudfront publish-function \
  --name my-url-rewrite \
  --if-match ETAG_VALUE

# Liệt kê functions
aws cloudfront list-functions

# Xem code function
aws cloudfront get-function --name my-url-rewrite --stage LIVE

# Xem CloudWatch metrics (requests trong 1 giờ qua)
aws cloudwatch get-metric-statistics \
  --namespace AWS/CloudFront \
  --metric-name Requests \
  --dimensions Name=DistributionId,Value=E1234567890 \
               Name=Region,Value=Global \
  --start-time $(date -u -v-1H +%Y-%m-%dT%H:%M:%S) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%S) \
  --period 300 \
  --statistics Sum

# Xem cache hit rate
aws cloudwatch get-metric-statistics \
  --namespace AWS/CloudFront \
  --metric-name CacheHitRate \
  --dimensions Name=DistributionId,Value=E1234567890 \
               Name=Region,Value=Global \
  --start-time $(date -u -v-1H +%Y-%m-%dT%H:%M:%S) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%S) \
  --period 300 \
  --statistics Average

# Tạo CloudWatch alarm cho 5xx errors
aws cloudwatch put-metric-alarm \
  --alarm-name "CloudFront-5xx-High" \
  --namespace AWS/CloudFront \
  --metric-name 5xxErrorRate \
  --dimensions Name=DistributionId,Value=E1234567890 \
               Name=Region,Value=Global \
  --statistic Average \
  --period 300 \
  --threshold 1 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 2 \
  --alarm-actions arn:aws:sns:us-east-1:111122223333:my-alerts

-- Tạo table cho CloudFront logs
CREATE EXTERNAL TABLE cloudfront_logs (
  `date` DATE,
  time STRING,
  location STRING,
  bytes BIGINT,
  request_ip STRING,
  method STRING,
  host STRING,
  uri STRING,
  status INT,
  referrer STRING,
  user_agent STRING,
  query_string STRING,
  cookie STRING,
  result_type STRING,
  request_id STRING
)
ROW FORMAT DELIMITED FIELDS TERMINATED BY '\t'
LOCATION 's3://my-cf-logs-bucket/cf-logs/';

-- Top 10 URIs có nhiều 5xx errors
SELECT uri, COUNT(*) as error_count
FROM cloudfront_logs
WHERE status >= 500 AND `date` >= '2026-04-01'
GROUP BY uri
ORDER BY error_count DESC
LIMIT 10;

-- Cache hit rate theo ngày
SELECT `date`,
  COUNT(CASE WHEN result_type = 'Hit' THEN 1 END) * 100.0 / COUNT(*) as hit_rate
FROM cloudfront_logs
GROUP BY `date`
ORDER BY `date` DESC;