resource "aws_cloudfront_distribution" "optimized" {
  enabled             = true
  is_ipv6_enabled     = true
  default_root_object = "index.html"

  origin {
    domain_name = "origin.example.com"
    origin_id   = "origin-group"

    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "origin-group"

    # Force browser + CDN to cache immutable assets
    response_headers_policy_id = aws_cloudfront_response_headers_policy.cache_optimized.id

    # Forward only necessary headers to prevent cache key fragmentation
    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
      headers = ["Accept", "Accept-Encoding"]
    }

    min_ttl     = 0
    default_ttl = 86400  # 24h for static
    max_ttl     = 31536000 # 1y for versioned assets
  }
}

resource "aws_cloudfront_response_headers_policy" "cache_optimized" {
  name = "cache-optimization"

  custom_headers_policy {
    items {
      header   = "Cache-Control"
      value    = "public, max-age=31536000, immutable"
      override = true
    }
    items {
      header   = "Vary"
      value    = "Accept-Encoding"
      override = true
    }
  }
}

curl -I https://cdn.example.com/static/app.v2.js
# Expected: Cache-Control: public, max-age=31536000, immutable
# Expected: X-Cache: Hit from cloudfront

export default {
  async fetch(request, env) {
    const url = new URL(request.url);
    const region = request.cf?.colo || 'unknown';
    const isStatic = /\.(js|css|png|jpg|webp|woff2)$/i.test(url.pathname);

    // Cost-optimized routing table
    const routes = {
      static: {
        us: 'https://cdn-a.example.com',
        eu: 'https://cdn-b.example.com',
        ap: 'https://cdn-c.example.com',
      },
      dynamic: {
        default: 'https://api.example.com'
      }
    };

    let target = isStatic ? routes.static[region] || routes.static['us'] : routes.dynamic.default;
    let newUrl = target + url.pathname + url.search;

    let response = await fetch(newUrl, {
      method: request.method,
      headers: request.headers,
      redirect: 'manual'
    });

    // Preserve original CDN cache behavior
    response.headers.set('X-Routed-CDN', region);
    return response;
  }
};

oss retransmissions, indirectly cutting bandwidth waste.

Nginx Origin Configuration (for CDN pull):

server {
    listen 443 ssl http2;
    server_name origin.example.com;

    # Brotli compression (requires ngx_brotli module)
    brotli on;
    brotli_comp_level 6;
    brotli_types text/plain text/css application/json application/javascript image/svg+xml;

    # Zstd fallback for modern clients
    add_header Content-Encoding $http_accept_encoding;

    # Disable compression for already-compressed formats
    map $sent_http_content_type $no_compress {
        default 0;
        ~image/ 1;
        ~video/ 1;
        ~application/zip 1;
    }

    location / {
        if ($no_compress) {
            brotli off;
        }
        proxy_pass http://backend;
    }
}

4. Smart Purge & Invalidation Automation

Blind cache purges trigger origin storms and force redundant re-caching. Smart invalidation targets specific keys, uses versioned URLs, and implements stale-while-revalidate patterns to maintain performance during updates.

Purge Automation (Python + CloudFront API):

import boto3
import hashlib
import time

def generate_cache_key(url, version):
    return f"{url}?v={version}"

def smart_purge(distribution_id, paths, batch_size=100):
    cf = boto3.client('cloudfront')
    batches = [paths[i:i+batch_size] for i in range(0, len(paths), batch_size)]
    
    for batch in batches:
        cf.create_invalidation(
            DistributionId=distribution_id,
            InvalidationBatch={
                'Paths': {'Quantity': len(batch), 'Items': batch},
                'CallerReference': f"{int(time.time())}-{hashlib.md5(str(batch).encode()).hexdigest()}"
            }
        )
    print(f"Invalidation submitted for {len(paths)} paths")

# Usage: Only purge versioned assets, never wildcards
smart_purge(
    distribution_id="E1A2B3C4D5E6F7",
    paths=[
        "/static/app.v2.js",
        "/static/styles.v2.css",
        "/images/hero.v3.webp"
    ]
)

---

Pitfall Guide

1. Cache Key Fragmentation

Problem: Forwarding unnecessary headers, cookies, or query parameters creates unique cache keys for identical content. A CDN may store 100 variants of the same image because of tracking parameters (?utm_source=...) or session cookies. Mitigation: Strip non-essential query strings at the edge. Use Vary headers only for content-negotiation (e.g., Accept-Encoding). Configure CDN cache keys to ignore analytics, auth, and device fingerprints unless strictly required for personalization.

2. The “Set and Forget” Compression Trap

Problem: Enabling compression without monitoring CPU overhead or client support leads to wasted compute cycles or broken responses. Some CDNs compress on-the-fly for every request, spiking edge compute costs. Mitigation: Pre-compress assets during build time (.br, .zst, .gz). Configure the CDN to serve pre-compressed variants when Accept-Encoding matches. Disable dynamic compression for large files (>10MB) and already-compressed media.

3. Origin Shield Over-Provisioning

Problem: Origin shields reduce origin load by caching at a single edge node before distributing to regional nodes. However, enabling it for highly dynamic or personalized content creates stale data delivery and unnecessary memory consumption. Mitigation: Use origin shields only for public, cacheable assets (images, JS, CSS). Disable for API endpoints, user-specific dashboards, or real-time data. Monitor shield hit ratios; if <60%, reconsider placement.

4. Dynamic Content Misclassification

Problem: Treating dynamic endpoints as static (or vice versa) causes either cache misses or stale responses. Forcing long TTLs on API data breaks functionality; short TTLs on static assets waste bandwidth. Mitigation: Implement path-based routing rules. Apply stale-while-revalidate and stale-if-error directives to bridge cache gaps without origin hits. Use edge functions to tag requests with Cache-Tag headers for granular invalidation.

5. Regional Pricing Blind Spots

Problem: Assuming uniform egress pricing across regions. AWS CloudFront, Cloudflare, and Fastly charge differently for North America, Europe, APAC, and South America. Unoptimized routing can push traffic through expensive zones. Mitigation: Map traffic distribution vs. vendor pricing tables. Use geo-DNS or edge workers to route APAC/South America traffic to providers with favorable regional rates. Negotiate committed use discounts for predictable traffic volumes.

6. Purge Storms & Cache Stampede

Problem: Bulk purges or wildcard invalidations (/*) trigger simultaneous origin requests, causing CPU spikes, timeouts, and cascading failures. Subsequent re-caching multiplies egress costs. Mitigation: Never use wildcard purges in production. Implement versioned URLs for deployments. Use Cache-Control: stale-while-revalidate=60 to serve stale content while refreshing in the background. Rate-limit purge requests and validate payload size before submission.

---

Production Bundle

Checklist

• Audit current cache hit ratio (target: >85% for static, >60% for dynamic)
• Map all cache keys and eliminate fragmentation sources
• Deploy Brotli/Zstd pre-compression in CI/CD pipeline
• Configure Cache-Control, Vary, and ETag headers consistently
• Implement path-based TTL routing (static vs. dynamic vs. personalized)
• Enable origin shield only for high-cacheability assets
• Set up multi-CDN routing or vendor arbitrage logic
• Replace wildcard purges with versioned invalidation + stale-while-revalidate
• Monitor egress cost per region and adjust routing accordingly
• Establish alerting for cache miss spikes and origin overload

Decision Matrix

Traffic Type	Recommended Strategy	TTL Range	Compression	Purge Method	Multi-CDN?
Static Assets (JS/CSS/Images)	Immutable + Versioned URLs	1 year	Pre-compressed Brotli/Zstd	Version bump	Optional
Dynamic APIs	Stale-while-revalidate	1m–5m	Edge Gzip/Brotli	Tag-based invalidation	Yes (latency-focused)
Personalized Content	Edge-side rendering + cookie segmentation	0–30s	None (or minimal)	Session-bound purge	No
Video/Media	Chunked delivery + HLS/DASH	24h+	Pre-fragmented	CDN-native purge	Yes (cost-focused)
High-Volume Regional	Geo-routed + committed discount	Varies	Pre-compressed	Batch versioned	Mandatory

Config Template

Terraform + CloudFront Cache Optimization Baseline:

variable "cdn_domain" { default = "cdn.example.com" }
variable "origin_domain" { default = "origin.example.com" }

resource "aws_cloudfront_distribution" "optimized_cdn" {
  enabled         = true
  is_ipv6_enabled = true
  price_class     = "PriceClass_100" # Adjust based on traffic geo

  origin {
    domain_name = var.origin_domain
    origin_id   = "primary"
    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "primary"

    forwarded_values {
      query_string = false
      cookies { forward = "none" }
      headers      = ["Accept", "Accept-Encoding"]
    }

    min_ttl     = 0
    default_ttl = 86400
    max_ttl     = 31536000

    compress = true
    viewer_protocol_policy = "redirect-to-https"
  }

  # Versioned static assets override
  ordered_cache_behavior {
    path_pattern     = "/static/*"
    target_origin_id = "primary"
    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]

    forwarded_values {
      query_string = false
      cookies      = { forward = "none" }
      headers      = ["Accept-Encoding"]
    }

    min_ttl     = 0
    default_ttl = 31536000
    max_ttl     = 31536000
    compress    = true
  }

  response_headers_policy_id = aws_cloudfront_response_headers_policy.security_and_cache.id
}

resource "aws_cloudfront_response_headers_policy" "security_and_cache" {
  name = "optimized-headers"

  custom_headers_policy {
    items {
      header   = "Cache-Control"
      value    = "public, max-age=31536000, immutable"
      override = true
    }
    items {
      header   = "Strict-Transport-Security"
      value    = "max-age=63072000; includeSubDomains; preload"
      override = true
    }
    items {
      header   = "X-Content-Type-Options"
      value    = "nosniff"
      override = true
    }
  }
}

Quick Start

1. Audit Current State: Run curl -I against 10 representative URLs. Log Cache-Control, X-Cache, Content-Encoding, and response size. Calculate current hit ratio and egress cost/GB.
2. Fix Cache Keys: Strip tracking parameters at the edge. Set forwarded_values.query_string = false for static routes. Add Vary: Accept-Encoding only where compression varies.
3. Deploy Pre-Compression: Integrate Brotli/Zstd into your build pipeline. Upload .br/.zst variants. Configure CDN to serve them when Accept-Encoding matches.
4. Implement Smart Invalidation: Replace /* purges with versioned URLs (/static/app.v2.js). Add stale-while-revalidate=60 to dynamic routes. Automate purge via CI/CD hooks.
5. Monitor & Iterate: Deploy cost/alerting dashboards (CloudWatch, Datadog, or provider-native). Track CacheHitRatio, OriginRequestCount, EgressGB, and CostPerRequest. Adjust TTLs, routing, and compression monthly based on traffic shifts.

Optimization is not a one-time task; it is a continuous feedback loop between architecture, configuration, and real-world traffic patterns. By treating CDN delivery as a programmable, measurable, and routable layer, engineering teams transform bandwidth from a cost center into a scalable, predictable infrastructure component.