Connect a domain name to an application, deliver private S3 content through CloudFront, control cached updates and verify HTTPS. Learn each concept by observing actual DNS answers, HTTP content and TLS checks.
Four guided labs teach DNS, private-origin delivery, cache freshness and HTTPS. The independent challenge restores an outdated customer page while preserving a separate cached object and private origin.
What You Will Learn
- Create an A record, query DNS and read the application through its name
- Connect a private S3 origin with OAC and a distribution-specific bucket policy
- Distinguish viewer access from anonymous direct-origin access
- Observe cache hits, TTL expiration and an origin update behind an old copy
- Invalidate only the affected viewer path and preserve another cached object
- Associate a supplied ACM certificate and test HTTPS, trust and hostname matching
- Diagnose stale content with independent origin, viewer and native-operation evidence
- Clean up only owned resources while preserving unrelated references
Who This Course Is For
This course is for beginners who want practical DNS and content-delivery skills after AWS Foundations, S3 object operations and IAM identity/resource-policy concepts. Full VPC, EC2, ALB and API Gateway courses are not prerequisites. Complete private S3 delivery before cache or HTTPS, and complete private delivery plus cache updates before the challenge. Follow the recommended order above; every unit starts independently in a fresh VM.
Learning environment: Use the provided browser-based LabEx Linux environment, Terminal for official AWS CLI commands and AWS View above it for the same resource state and actual request results. Tools, scoped access and unrelated fixtures are prepared. You do not need a personal AWS account, access keys or a purchased domain. Reuse knowledge, not earlier VM resources.
Frequently Asked Questions
Does uploading a new S3 object immediately replace a cached page?
Not while a previously cached response remains fresh. Observe the origin and viewer separately, then test expiration or a targeted invalidation using actual returned bytes.
Does HTTPS make the S3 origin private?
No. Viewer encryption, certificate trust/name checks and the origin access policy are separate protections. Test both permitted delivery and denied direct access.
Will I register a domain or request a public certificate?
No. The course supplies practice names and a private-CA certificate. Trust the public practice CA only for individual commands; keep system DNS and trust stores unchanged. Public websites require public DNS and publicly trusted certificates.
Does this demonstrate global CDN performance?
No. The course practices focused DNS records, same-account private S3 reads, cache lifetimes, exact-path invalidation and real TLS. Global edge deployment, public certificate issuance, broad routing policies and advanced cache-policy features are outside these units. Functional checks come before cleanup; successful queries establish resource absence.
