AWS field guide
Cache public content at the edge
Make cacheability an explicit property of every response, with private and dynamic paths separated from public delivery.
Use this pattern when
Content is read frequently, changes less often than it is requested, and serves users across regions.
Reference architecture
Responsibilities and controls, not a deployment template.
Reader
Global request
Amazon CloudFront
Cache and edge policy
Cache policy
Explicit key and TTL
Amazon S3
Private static origin
AWS Lambda
Dynamic application origin
Decisions that shape the pattern
- Define cache keys deliberately.
- Use immutable names for versioned assets.
- Choose TTLs from content freshness requirements.
Security boundaries
- Keep origins private.
- Never cache user-specific responses publicly.
- Apply response headers and edge protection consistently.
Reliability posture
- Use stale content where acceptable.
- Protect origins from request floods.
- Test invalidation and rollback paths.
Starter implementation
Start from deployable infrastructure
Review every permission, limit, Region, and cost assumption before production.
import { Duration, Stack, StackProps } from 'aws-cdk-lib';
import * as apigateway from 'aws-cdk-lib/aws-apigateway';
import * as athena from 'aws-cdk-lib/aws-athena';
import * as bedrock from 'aws-cdk-lib/aws-bedrock';
import * as budgets from 'aws-cdk-lib/aws-budgets';
import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
import * as origins from 'aws-cdk-lib/aws-cloudfront-origins';
import * as cloudtrail from 'aws-cdk-lib/aws-cloudtrail';
import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as patterns from 'aws-cdk-lib/aws-ecs-patterns';
import * as events from 'aws-cdk-lib/aws-events';
import * as targets from 'aws-cdk-lib/aws-events-targets';
import * as glue from 'aws-cdk-lib/aws-glue';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as kms from 'aws-cdk-lib/aws-kms';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as sources from 'aws-cdk-lib/aws-lambda-event-sources';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
import * as sqs from 'aws-cdk-lib/aws-sqs';
import { Construct } from 'constructs';
export class PatternStack extends Stack {
constructor(scope: Construct, id: string, props?: StackProps) {
super(scope, id, props);
const origin = new s3.Bucket(this, 'Origin', {
blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
encryption: s3.BucketEncryption.S3_MANAGED,
});
new cloudfront.Distribution(this, 'Distribution', {
defaultBehavior: {
origin: origins.S3BucketOrigin.withOriginAccessControl(origin),
cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
},
});
}
}
Before production
Adoption checklist
- 01Classify every route as public or private.
- 02Document cache keys.
- 03Set browser and CDN TTLs.
- 04Test an origin outage.
- 05Monitor cache-hit ratio.
From the journal
Related field notes
Selected from service names and architecture signals used by this pattern.
AWS Health Version Catalog: Proactive Lifecycle Management?
AWS Health now offers a version catalog, aiming to shift software lifecycle management from reactive to proactive. But what's the real cost?
AWS Lambda Best Practices: Building Serverless Applications
Learn the essential best practices for building efficient, scalable, and maintainable serverless applications with AWS Lambda. From cold start optimization to error handling and security.
Accelerating Local Serverless Development with Console-to-IDE and Remote Debugging for AWS Lambda
AWS has introduced a game-changer: Console-to-IDE integration with Remote Debugging for AWS Lambda. Learn how to debug Lambda functions in real-time with breakpoints, variable inspection, and local test events.
Was this playbook useful?
One click helps prioritize deeper examples and updates.