3 ms·

> Our static site has origins in multiple regions via CloudFront and didn’t seem to be impacted This seems like such a low bar for 2025, but here we are.

immibis 1y ago
You're also betting that CloudFront isn't one of the several AWS services that only works when us-east-1 is up.
- mlhpdx 1y ago
  Yeah, it's not clear how resilient CloudFront is but it seems good. Since content is copied to the points of presence and cached it's the lightly used stuff that can break (we don't do writes through CloudFront, which in IMHO is an anti-pattern). We setup multiple "origins" for the content so hopefully that provides some resiliency -- not sure if it contributed positively in this case since CF is such a black box. I might setup some metadata for the different origins so we can tell which is in use.
  - x3n0ph3n3 1y ago
    CloudFront isn't just for CDN, but also for DDoS protection. Writes through CloudFront are not an anti-pattern.
    - mlhpdx 1y ago
      There is always more than a way to do things with AWS. But CloudFront Origin groups can’t use HTTP POST. They’re limited to read requests. Without origin groups you opt-out of some resiliency. IMHO that’s a bad trade-off. To each their own.
      - x3n0ph3n3 1y ago
        WAF is cheaper on CloudFront and so is traffic (compared to the ALB). It keeps bad traffic near the sender rather than near the recpient.
- nothrabannosir 1y ago
  afaik cloudfront TLS certs and access logs S3 buckets must be stored in us-east-1
  - mlhpdx 1y ago
    True for certs but not the log bucket (but it’s still going to be in a single region, just doesn’t have to be Virginia). I’m guessing those certs are cached where needed, but I can also imagine a perfect storm where I’m unable to rotate them due to an outage. I prefer the API Gateway model where I can create regional endpoints and sew them together in DNS.
- melbourne_mat 1y ago
  Yep if you wrote lambda@edge functions, which are part of Cloudfront and can be used for authentication among other things, they can only be deployed to us-east-1
- nijave 1y ago
  I was under the impression it's similar to IAM where the control plane is in us-east-1 and the config gets replicated to other regions. In that case, existing stuff would likely continue to work but updates may fail

immibis 1y ago

You're also betting that CloudFront isn't one of the several AWS services that only works when us-east-1 is up.

mlhpdx 1y ago
Yeah, it's not clear how resilient CloudFront is but it seems good. Since content is copied to the points of presence and cached it's the lightly used stuff that can break (we don't do writes through CloudFront, which in IMHO is an anti-pattern). We setup multiple "origins" for the content so hopefully that provides some resiliency -- not sure if it contributed positively in this case since CF is such a black box. I might setup some metadata for the different origins so we can tell which is in use.
- x3n0ph3n3 1y ago
  CloudFront isn't just for CDN, but also for DDoS protection. Writes through CloudFront are not an anti-pattern.
  - mlhpdx 1y ago
    There is always more than a way to do things with AWS. But CloudFront Origin groups can’t use HTTP POST. They’re limited to read requests. Without origin groups you opt-out of some resiliency. IMHO that’s a bad trade-off. To each their own.
    - x3n0ph3n3 1y ago
      WAF is cheaper on CloudFront and so is traffic (compared to the ALB). It keeps bad traffic near the sender rather than near the recpient.
nothrabannosir 1y ago
afaik cloudfront TLS certs and access logs S3 buckets must be stored in us-east-1
- mlhpdx 1y ago
  True for certs but not the log bucket (but it’s still going to be in a single region, just doesn’t have to be Virginia). I’m guessing those certs are cached where needed, but I can also imagine a perfect storm where I’m unable to rotate them due to an outage. I prefer the API Gateway model where I can create regional endpoints and sew them together in DNS.
melbourne_mat 1y ago
Yep if you wrote lambda@edge functions, which are part of Cloudfront and can be used for authentication among other things, they can only be deployed to us-east-1
nijave 1y ago
I was under the impression it's similar to IAM where the control plane is in us-east-1 and the config gets replicated to other regions. In that case, existing stuff would likely continue to work but updates may fail