Deploy CloudFront from day one for static assets. It’s effectively free at low traffic (1TB free tier) and gives you global performance without multi-region infrastructure.
Skip WAF until you see abuse. WAF adds $5/month minimum + per-request costs.
Use versioned filenames (app.abc123.js) from the start — never rely on invalidations.

Post-PMF / Growth ($1M-$10M ARR)

Add WAF when you have traffic worth protecting or compliance requirements.
Add CloudFront in front of API Gateway only if you need geographic caching of API responses or need to combine static + API under one domain.
Consider CloudFront Functions (not Lambda@Edge) for header manipulation — 1/6th the cost.

Cost Traps

Trap	Impact	Fix
Invalidation as deploy strategy	Free only for first 1,000 paths/month, then $0.005/path. Daily deploys with `/*` = waste.	Use content-hashed filenames. Zero invalidation cost.
Lambda@Edge for simple tasks	Charged per request + duration at 3x Lambda pricing	Use CloudFront Functions for header manipulation, redirects, URL rewrites ($0.10/million vs $0.60/million)
Data transfer out to internet	$0.085/GB after 1TB free tier — this is often the biggest line item for media-heavy startups	Enable compression (saves 60-80% on text), use appropriate image formats, consider S3 Transfer Acceleration only if upload-heavy
Origin Shield without need	Additional caching layer at $0.0090/10K requests	Only valuable if you have 3+ edge locations hitting origin frequently

Counterintuitive Advice

CloudFront in front of Lambda Function URLs is often better than API Gateway. You get custom domains, caching, and WAF at CloudFront cost ($0.085/GB + $0.01/10K requests) instead of API Gateway cost ($1.00/million requests). For a startup doing 10M requests/month on small payloads: CloudFront = ~$10, HTTP API = $10, REST API = $35. But CloudFront gives you the caching layer for free.
Don’t use edge-optimized API Gateway endpoints. They silently create a CloudFront distribution you can’t configure. Use regional + your own CloudFront if you need CDN.
The free tier (1TB/month transfer, 10M requests) is generous. Most pre-PMF startups never exceed it. Don’t optimize what costs you $0.

When to Add CloudFront (if not already using it)

You’re paying too much for origin compute/bandwidth when:

Your origin (ALB, API Gateway, S3) data transfer exceeds $50/month
You’re serving the same API response to many users within a time window (cacheable)
You need to serve users on multiple continents without multi-region deployment

Configuration Decisions (Get These Right on Day 1)

Origins

Use Origin Access Control (OAC) — not the legacy Origin Access Identity (OAI). OAC supports SSE-KMS and all S3 features; OAI does not.
For S3 static website hosting endpoints, use custom origin (not S3 origin type) — the website endpoint is HTTP-only.
For API origins, use CachingDisabled managed policy unless you explicitly control TTLs and cache keys.
Use regional API Gateway endpoints, not edge-optimized (avoids double CloudFront hop).

Caching

Forward only what the origin needs — extra headers/cookies/query strings destroy cache hit ratio. Use separate cache and origin request policies.
Enable automatic compression (Gzip + Brotli) in cache behavior — saves 60-80% on text assets.

Security

ACM certificate must be in us-east-1 for CloudFront. They’re free and auto-renew.
Add security response headers via response headers policy: HSTS, X-Content-Type-Options, X-Frame-Options.
Never use self-signed certs with custom domains.

CloudFront data transfer is covered by AWS Activate credits. If you have $100K in credits, don’t optimize CloudFront costs — optimize for developer velocity instead. Revisit when credits are within 6 months of expiring.

references/cloudfront.md

Raw file

aws/agent-toolkit-for-aws