CloudFront vs ALB
Global CDN with edge caching versus regional application load balancer for web traffic.
Overview
What is being compared
Both sit in front of web traffic on AWS, at different scopes. CloudFront is a global content delivery network that caches responses at edge locations, cutting latency for users far from the origin and offloading origin traffic. ALB distributes traffic to backend targets within one region.
- Scope — Global, 400+ edge locations — One region
- Caching — Yes, by Cache-Control headers and cache policies — None
- Code at the edge — Lambda@Edge, CloudFront Functions — None
- AWS WAF and Shield — Blocks traffic before it reaches the origin — Protects only after traffic reaches your VPC
- Workloads called out — Static assets, cacheable API responses — gRPC, WebSocket, internal microservice routing
- Best for — Global users, static delivery, edge protection — Regional or internal APIs, content not worth caching
How they fit together
For a global application CloudFront sits in front of the ALB. A cache hit is answered at the edge; only misses and uncacheable requests travel to the region.
The cache key decides who shares a cached response. Leave the auth cookie out of it, and the second user is answered with the first user's page:
> [!WARNING] Without the auth cookie or header in the cache key, CloudFront can serve one user's authenticated response to another user.
Which one to pick
Put CloudFront in front of the ALB when users are globally distributed or much of the content is cacheable, or when you need WAF to block traffic before it reaches the origin. Otherwise use the ALB directly, for a regional or internal API.
> [!TIP] Where each service sits, three requests through CloudFront's cache behaviors, and the questions that decide it, step by step in Visual Explanation below.
Sign up free to read the full topic
More Comparisons topics
Start free on Cariara · Coding problems · System design studio