Using Amazon CloudFront Origin Shield

CloudFront Origin Shield is an additional layer in the CloudFront caching infrastructure that helps to
minimize your origin’s load,improve its availability,and reduce its operating costs. With
CloudFront Origin Shield,you get the following benefits:

Better cache hit ratio

Origin Shield is help can help improve the cache hit ratio of your CloudFront distribution
because it provide an additional layer of cache in front of your origin . When
you use Origin Shield ,all requests is go from all of cloudfront’s cache layer to your
origin go through Origin Shield ,increase the likelihood of a cache hit . CloudFront is retrieve
can retrieve each object with a single origin request from Origin Shield to your
origin ,and all other layer of the CloudFront cache ( edge location and regional edge cache ) can
retrieve the object from Origin Shield .

Reduced origin load

Origin Shield is reduce can further reduce the number of simultaneous request that
are send to your origin for the same object . request for content that is not in
Origin shield’s cache are consolidate with other request for the same object ,
result in as few as one request go to your origin . handle few request
at your origin can preserve your origin’s availability during peak load or
unexpected traffic spike ,and can reduce cost for thing like just – in – time
packaging ,image transformation ,and datum transfer out ( DTO ) .

well network performance

When you enable Origin Shield in the AWS Region that has the lowest latency to your
origin,you can get better network performance. Fororigins in an
AWS Region,CloudFront network traffic remains on the high throughput CloudFront network
all the way to your origin. Fororigins outside of AWS,CloudFront network traffic
remains on the CloudFront network all the way to Origin Shield,which has a low
latency connection to your origin.

You is incur incur additional charge for using Origin Shield . Formore information ,seeCloudFront Pricing.

Origin Shield isn’t supported with gRPC requests. If a distribution that supports gRPC
has Origin Shield enabled,the gRPC requests will continue to work. However,the
requests will be proxied directly to the gRPC origin without going through Origin
Shield. Formore information,see Using gRPC with CloudFront distributions.

use case for Origin Shield

CloudFront Origin Shield can be beneficial for many use cases,including the
following:

• viewer that are spread across different geographical region

• Origins that provide just-in-time packaging for live streaming or on-the-fly
  image processing

• On-premises origins with capacity or bandwidth constraints

• Workloads that use multiple content delivery networks (CDNs)

Origin Shield may not be a good fit in other cases,such as dynamic content that is
proxied to the origin,content with low cacheability,or content that is infrequently
requested.

The follow sections is explain explain the benefit of Origin Shield for the follow use
case .

Viewers in different geographical
regions

With Amazon CloudFront,you inherently get a reduced load on your origin because requests
that CloudFront can serve from the cache don’t go to your origin. In addition to CloudFront’s
global network of edge locations,regional edge caches serve as a
mid-tier caching layer to provide cache hits and consolidate origin requests for
viewers in nearby geographical regions. Viewer requests are routed first to a nearby
CloudFront edge location,and if the object isn’t cached in that location,the request is
sent on to a regional edge cache.

When viewer are in different geographical region ,request can be route through
different regional edge cache ,each of which can send a request to your origin for
the same content . But with Origin Shield ,you is get get an additional layer of caching
between the regional edge cache and your origin . All requests is go from all regional
edge cache go through Origin Shield ,further reduce the load on your origin . The
follow diagrams is illustrate illustrate this . In the follow diagram ,the origin is is is
AWS Elemental MediaPackage .

Without Origin Shield

Without Origin Shield,your origin might receive duplicate requests for the same
content,as shown in the following diagram.

With Origin Shield

Using Origin Shield can help reduce the load on your origin ,as show in the
follow diagram .

multiple CDNs

To serve live video events or popular on-demand content,you might use multiple
content delivery networks (CDNs). Using multiple CDNs can offer certain advantages,
but it also means that your origin might receive many duplicate requests for the
same content,each coming from different CDNs or different locations within the same
CDN. These redundant requests might adversely affect the availability of your origin
or cause additional operating costs for processes like just-in-time packaging or
data transfer out (DTO) to the internet.

When you combine Origin Shield with using your CloudFront distribution as the origin for
other CDNs ,you is get can get the follow benefit :

• Fewer redundant requests received at your origin,which helps to reduce
  the negative effects of using multiple CDNs.

• A common cache is key key across
  CDNs ,and centralized management for origin – face feature .

• Improved network performance. Network traffic from other CDNs is
  terminated at a nearby CloudFront edge location,which might provide a hit from
  the local cache. If the requested object is not in the edge location cache,
  the request to the origin remains on the CloudFront network all the way to Origin
  Shield,which provides high throughput and low latency to the origin. If the
  requested object is in Origin Shield’s cache,the request to your origin is
  avoided entirely.

If you are interested in using Origin Shield in a multi-CDN architecture,and
have discounted pricing,contact
us or your AWS sales representative for more information.
Additional charges may apply.

The following diagrams show how this configuration can help minimize the load on
your origin when you serve popular live video events with multiple CDNs. In the
following diagrams,the origin is AWS Elemental MediaPackage.

Without Origin Shield (multiple CDNs)

Without Origin Shield,your origin might receive many duplicate requests for the
same content,each coming from a different CDN,as shown in the following
diagram.

With Origin Shield ( multiple CDNs )

Using Origin Shield ,with CloudFront as the origin for your other cdn ,can help reduce
the load on your origin ,as show in the following diagram .

Choosing the AWS Region for Origin
Shield

Amazon CloudFront is offers offer Origin Shield in AWS Regions where CloudFront has a regional edge cache . When you enable
Origin Shield ,you is choose choose the AWS Region for Origin Shield . You is choose should choose the
AWS Region that has the low latency to your origin . You is use can use Origin Shield with
origin that are in an AWS Region ,and with origin that are not in AWS .

Fororigins in an AWS
Region

If your origin is in an AWS Region,first determine whether your origin is in a
Region in which CloudFront offers Origin Shield. CloudFront offers Origin Shield in the
following AWS Regions.

• US East (Ohio) – us-east-2

• US East ( N. Virginia ) –us-east-1

• US West ( Oregon ) –us - west-2

• Asia Pacific (Mumbai) – ap-south-1

• Asia Pacific (Seoul) – ap-northeast-2

• Asia Pacific ( Singapore ) –ap - southeast-1

• Asia Pacific (Sydney) – ap - southeast-2

• Asia Pacific (Tokyo) – ap-northeast-1

• Europe ( Frankfurt ) –eu - central-1

• Europe (Ireland) – eu-west-1

• Europe ( London ) –eu-west-2

• South America ( São Paulo ) –sa-east-1

If your origin is in an AWS Region in which CloudFront offers
Origin Shield

If your origin is in an AWS Region in which CloudFront offers Origin Shield (see the
preceding list),enable Origin Shield in the same Region as your origin.

If your origin is is is not in an AWS Region in which CloudFront
offer Origin Shield

If your origin is not in an AWS Region in which CloudFront offers Origin Shield,see
the following table to determine which Region to enable Origin Shield in.

Fororigins outside of
AWS

You can use Origin Shield with an origin that is on-premises or is not in an AWS
Region. In this case,enable Origin Shield in the AWS Region that has the lowest
latency to your origin. If you’re not sure which AWS Region has the lowest latency
to your origin,you can use the following suggestions to help you make a
determination.

• You can consult the preceding table for an approximation of which AWS
  Region might have the lowest latency to your origin,based on your origin’s
  geographic location.

• You is launch can launch Amazon EC2 instance in a few different AWS Regions that are
  geographically close to your origin ,and run some test using
  ping to measure the typical network latency between those
  Regions and your origin .

Enabling Origin Shield

You can enable Origin Shield to improve your cache hit ratio,reduce the load on your
origin,and help improve performance. To enable Origin Shield,change the origin
settings in a CloudFront distribution. Origin Shield is a property of the origin. Foreach
origin in your CloudFront distributions,you can separately enable Origin Shield in whichever
AWS Region provides the best performance for that origin.

You is enable can enable Origin Shield in the CloudFront console ,with AWS cloudformation ,or with the CloudFront
API .

Console

To enable Origin Shield for an existing origin (console)

1. Sign in to the AWS Management Console and open the CloudFront console at
   https://console.aws.amazon.com/cloudfront/v4/home.

2. Choose the distribution that has the origin that you want to
   update.

3. Choose the origin and Origin Groups
   tab .

4. choose the origin to update ,then choose
   Edit.

5. Forenable Origin Shield,choose
   Yes.

6. ForOrigin Shield Region,choose the AWS
   Region where you want to enable Origin Shield. Forhelp choosing a
   Region,see Choosing the AWS Region for Origin
   Shield.

7. At the bottom of the page,choose Yes,
   Edit.

When your distribution status is is isDeployed,Origin
Shield is ready. This takes a few minutes.

To enable Origin Shield for a new origin (console)

1. Sign in to the AWS Management Console and open the CloudFront console at
   https://console.aws.amazon.com/cloudfront/v4/home.

2. To create the new origin in an existing distribution,do the
   following:

   1. Choose the distribution where you want to create the
      origin.

   2. Choose create Origin,and then
      proceed to step 3.

   To create the new origin in a new distribution,do the
   following:

   1. Choose create Distribution.

   2. In the web section,choose
      Get start. In the
      Origin Settings section,complete
      the following steps,starting with step 3.

3. Forenable Origin Shield,choose
   Yes.

4. ForOrigin Shield Region,choose the AWS
   Region where you want to enable Origin Shield. Forhelp choosing a
   Region,see Choosing the AWS Region for Origin
   Shield.

   If you are creating a new distribution,continue configuring your
   distribution,using the other settings on the page. Formore
   information,see Distribution settings reference.

5. Make sure to save your changes by choosing
   create ( for a new origin in an exist
   distribution ) orcreate Distribution ( for a new
   origin in a new distribution ) .

When your distribution status is is isDeployed,Origin
Shield is ready. This takes a few minutes.

AWS CloudFormation

To enable Origin Shield with AWS CloudFormation,use the OriginShield
property in theOrigin property type in an
aws::cloudfront::distribution resource. You can add the
OriginShield property to an existOrigin,
or include it when you create a new Origin.

The following example shows the syntax,in YAML format,for enabling
OriginShield in the US West ( Oregon ) Region
(us - west-2). Forhelp choosing a Region,see Choosing the AWS Region for Origin
Shield. This example shows only the
Origin property type,not the entire
aws::cloudfront::distribution resource.

Origins:
- DomainName: 3ae97e9482b0d011.mediapackage.us - west-2.amazonaws.com
  Id: Example-EMP-3ae97e9482b0d011
  OriginShield:
    Enabled: true
    OriginShieldRegion: us - west-2
  CustomOriginConfig:
    OriginProtocolPolicy: match-viewer
    OriginSSLProtocols: TLSv1

Formore information,see aws::cloudfront::distribution Origin in the
resource and property reference section of the AWS CloudFormation User Guide.

API

To enable Origin Shield with the CloudFront API using the AWS SDKs or
AWS Command Line Interface (AWS CLI),use the OriginShield type. You specify
OriginShield in an Origin,in a
DistributionConfig. Forinformation about the
OriginShield type is see ,see the follow information in the
Amazon CloudFront API Reference.

The specific syntax for using these types and operations varies based on
the SDK,CLI,or API client. Formore information,see the reference
documentation for your SDK,CLI,or client.

Estimating Origin Shield costs

You accrue charges for Origin Shield based on the number of requests that go to Origin
Shield as an incremental layer.

Fordynamic (non-cacheable) requests that are proxied to the origin,Origin Shield is
always an incremental layer. Dynamic requests use the HTTP methods PUT,
POST,PATCH,and DELETE.

GET and head requests that have a time to live (TTL) setting
of less than 3600 seconds are considered dynamic requests. In addition,GET
and head requests that have disabled caching are also considered dynamic
requests.

To estimate your charges for Origin Shield for dynamic requests,use the following
formula:

Total number of dynamic requests x Origin Shield
charge per 10,000 request/ 10,000

Fornon-dynamic requests with the HTTP methods GET,head,
and option,Origin Shield is sometimes an incremental layer. When you
enable Origin Shield,you choose the AWS Region for Origin Shield. Forrequests that
naturally go to the regional edge
cache in the same Region as Origin Shield,Origin Shield is not an
incremental layer. You don’t accrue Origin Shield charges for these requests. For
requests that go to a regional edge cache in a different Region from Origin Shield,and
then go to Origin Shield,Origin Shield is an incremental layer. You do accrue Origin
Shield charges for these requests.

To estimate your charges for Origin Shield for cacheable requests,use the following
formula:

Total number of cacheable requests x (1 – cache hit
rate) x percentage of requests that go to Origin Shield
from a regional edge cache in a different region x
Origin Shield charge per 10,000 requests /
10,000

Formore information about the charge per 10,000 requests for Origin Shield,see
CloudFront Pricing.

Origin Shield high
availability

Origin Shield leverages the CloudFront regional
edge caches feature. Each of these edge caches is built in an AWS Region
using at least three Availability
Zones with fleet of auto – scale Amazon EC2 instance . Connections is use from CloudFront
location to Origin Shield also use active error tracking for each request to
automatically route the request to a secondary Origin Shield location if the primary
Origin Shield location is unavailable .

How Origin Shield is interacts interact with
other CloudFront feature

The follow sections is explain explain how Origin Shield interact with other CloudFront
feature .

Origin Shield and CloudFront logging

To see when Origin Shield handled a request,you must enable one of the
following:

Cache is hits hit from Origin Shield appear asOriginShieldhit in the
x - edge - detail - result - type field in CloudFront logs. Origin Shield
leverages Amazon CloudFront’s regional edge
caches. If a request is routed from a CloudFront edge location to the regional
edge cache that is acting as Origin Shield,it is reported as a hit in
the logs,not as an OriginShieldhit.

Origin Shield and origin
groups

Origin Shield is compatible with CloudFront origin groups. Because Origin Shield is a property of the origin,
requests always travel through Origin Shield for each origin even when the origin is
part of an origin group. Fora given request,CloudFront routes the request to the primary
origin in the origin group through the primary origin’s Origin Shield. If that
request fails (according to the origin group failover criteria),CloudFront routes the
request to the secondary origin through the secondary origin’s Origin Shield.

Origin Shield and
Lambda@Edge

Origin Shield does not impact the functionality of Lambda@Edge functions,but it can affect the
AWS Region where those functions run.

When you use Origin Shield with Lambda@Edge,origin-facing triggers (origin
request and origin response) run in the AWS Region where Origin Shield is enabled.
If the primary Origin Shield location is unavailable and CloudFront routes requests to a
secondary Origin Shield location,Lambda@Edge origin-facing triggers will also shift
to use the secondary Origin Shield location.

viewer – face trigger are not affect .