Amazon CloudFront: CDN | DNSTrace.dev

Explore Amazon CloudFront’s CDN, distributions and origins, with practical guidance on caching, custom domains and delivering content from AWS or another host.

Updated 8 September 2026

What is Amazon CloudFront used for?

CloudFront distributes static and dynamic HTTP content through AWS edge locations. Its origins can include an S3 bucket or an HTTP server. That makes it useful for serving a collection of files as well as placing a delivery layer in front of an application.

Consider a documentation site whose generated pages and images are stored in S3. CloudFront can be the public delivery layer while the bucket remains the source of the files. For an application, the source might instead be an HTTP backend that generates a response when requested.

Distributions, origins and cache freshness

A distribution describes where CloudFront fetches content and how it delivers that content. It receives a CloudFront domain name and can be associated with a custom domain. When the selected edge has a usable cached object, it can answer locally; otherwise it retrieves the object from an origin.

A useful deployment pattern is to give each release’s assets new filenames. An updated page can then reference the new files without relying on every cached copy of an older file expiring at the same moment.

CloudFront Functions and Lambda@Edge

CloudFront supports code that customizes requests and responses. CloudFront Functions targets lightweight JavaScript logic such as URL normalization and redirects. Lambda@Edge supports more involved logic in its supported runtimes. The two have different events, restrictions and capabilities; selecting one is an architecture decision rather than simply choosing a programming language.

For example, a distribution can rewrite an incoming URL before looking up content, while more complex origin-facing work can use a suitable Lambda@Edge trigger. These functions extend CloudFront’s delivery pipeline. They are distinct from running a general application backend on a regional AWS service.

Choosing what belongs behind CloudFront

Start with the origin and access requirements. Public documentation, private downloads and personalized application responses need different policies. CloudFront documents signed URLs and signed cookies for private content, but access controls still have to match the way the application grants permission.

Review usage costs against the expected traffic pattern, including request volume and delivery geography. A small file requested frequently and a large file downloaded occasionally can produce very different workloads.

How DNSTrace.dev detects Amazon CloudFront

Detection correlates independent public signals. A single match is reported as strong evidence; agreement between a response header and the announcing network is reported as confirmed.

x-amz-cf-id — Encrypted per-request identifier.
x-amz-cf-pop — The three-letter edge location code that served the request.
server: CloudFront — Present on many distributions.
via header naming cloudfront.net — Added by the CloudFront proxy.
CNAME targets under cloudfront.net — The distribution hostname.
AS16509 — The Amazon autonomous system commonly announcing the edge address.

What a detection proves

The request was served by a CloudFront edge location, and identifies which one.

What it does not prove

Whether the origin is also on AWS. CloudFront can front any public origin, including one on another provider entirely.

Common questions about Amazon CloudFront

What is a CloudFront distribution?

It is a configuration that connects one or more origins to CloudFront’s delivery network. CloudFront assigns it a hostname, and the operator can configure an alternate domain name for visitors.

Does a CloudFront detection mean the site runs on AWS?

Not necessarily. CloudFront accepts any reachable public origin, so the application behind it can be hosted anywhere.

Is x-amzn-waf-action related to CloudFront?

It indicates AWS WAF, which is frequently attached to a CloudFront distribution but is a separate product. DNSTrace.dev reports it as a firewall signal rather than a delivery signal.

Developer platform, CDN and security