CDN Architecture

Edge PoPs, cache hierarchies, cache invalidation, origin shield, and CloudFront vs Fastly.

Overview

Overview A CDN (Content Delivery Network) is a geographically distributed network of cache servers (Points of Presence, PoPs) that serve content from locations close to the user, reducing latency and origin load.

When a user requests a resource, DNS routes them to the nearest PoP via anycast or GeoDNS. The PoP checks its cache (cache hit): returns the cached response. Cache miss: fetches from origin (or from a parent PoP in a hierarchy), caches the response, returns it to the user.

Cache hierarchy: edge PoP (closest to user) → regional PoP (mid-tier, optional) → origin shield (single point of entry to origin) → origin server. The origin shield concentrates all cache misses into one location, dramatically reducing the number of requests hitting the origin. Without it, a cache miss on the edge sends requests from 200 PoPs directly to the origin during a spike.

Cache keys determine uniqueness. By default: URL. Custom cache keys can include headers (Accept-Language, User-Agent), cookies (session cookie), or query parameters. The wider the cache key, the lower the hit rate. The narrower the key, the higher the hit rate but the less personalised content can be cached.

Cache invalidation: TTL-based (content expires and is re-fetched), explicit invalidation (CDN API call to purge a URL or pattern), surrogate keys (tag resources with a key, purge all resources with that tag). Instant invalidation is expensive (it propagates to all PoPs). Batch and tag-based invalidation (Fastly, Varnish) are more efficient.

Cloudfront behaviors map URL patterns to cache policies and origins. You can serve HTML from an S3 bucket (static), API calls from an ALB (dynamic, cache bypass), and assets from another S3 bucket (long TTL), all behind the same CloudFront distribution.

Key concepts

Edge PoP
CDN server in a specific geographic location. Responds to DNS queries routed by anycast or GeoDNS. First cache layer for users in that region.
Origin shield
A single CDN PoP that acts as the sole point of contact with the origin. All other PoPs that miss fetch from the shield. Reduces origin load dramatically during traffic spikes.
Cache key
The combination of attributes (URL, headers, cookies, query params) that uniquely identifies a cached response. Narrower key = higher hit rate. Wider key = more variation cached.
Surrogate keys (cache tags)
Tags applied to cached objects that allow bulk invalidation. Purge all objects tagged "product-123" to clear a product page across all PoPs without listing every URL.
Stale-while-revalidate
Cache serves the stale response immediately while fetching a fresh version in the background. Eliminates user-facing latency on cache misses at the cost of briefly serving stale content.

When to use it

  • Designing a global web application serving users across regions
  • Explaining cache invalidation strategies after a content update
  • Configuring CloudFront to serve both static assets and dynamic API through a single domain
  • Reducing S3 origin costs by caching assets at CDN edges with long TTLs

Interview questions

  • How would you architect a CloudFront distribution to serve both static assets and a dynamic API through the same domain?

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio