> ## Documentation Index > Fetch the complete documentation index at: https://cloud-architect.ipoint-labs.com/llms.txt > Use this file to discover all available pages before exploring further. # Introduction to Amazon CloudFront > Hands-on lab · 30m Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console. Open IP Lab Portal ## Overview ### Lab details 1. Welcome to this comprehensive lab that will guide you through the process of creating an Amazon CloudFront distribution, which will allow you to distribute a publicly accessible image file from an Amazon S3 bucket. 2. This tutorial will explain how to utilize custom error pages and geo-restriction. It will guide you through the process of configuring these features. 3. Duration: **1 hour 30 minutes** 4. AWS Region: **US East (N. Virginia) us-east-1** ### Introduction #### What is CloudFront? * Amazon CloudFront is a content delivery network (CDN) offered by AWS. * CDN provides a globally-distributed network of proxy servers which cache content , i.e., web videos or other bulky media, more locally to consumers, thus improving access speed for downloading the content. * CloudFront service works on a pay-as-you-go basis. * CloudFront works with origin servers like S3, EC2 where the content is stored and is pushed out to multiple CloudFront servers as content is requested. * When CloudFront is enabled, the content is stored on the main S3 server. * Copies of this content are created on a network of servers around the world called CDN. * Each server within this network is called an Edge server, which will only have a copy of your content. * When a request is made to the content, the user is provided from the nearest edge server. * CloudFront has features similar to dynamic site acceleration, a method used to improve online content delivery. * CloudFront accelerates the delivery of dynamic content by moving it closer to the user to minimize internet hops involved in retrieving the content. * CloudFront's Web distribution supports "**Progressive**" download i.e., data from S3 is cached and then streamed without disruptions. * Due to that, the user cannot move front or back in the video i.e., the video is processed bit by bit. * CloudFront's Web distribution support "**Streaming**" allows users to directly watch without any download. * Due to that, the user can move front or back in the video, the latency is based on the size of the file and the customer's Internet bandwidth. * This service is beneficial for those developing a website that distributes a lot of content and needs to scale-up. * It helps reduce costs and improve the performance of a website by providing high data transfer speeds and low latency. ### Architecture diagram ### Task details 1. Sign in to AWS Management Console 2. Create an S3 Bucket 3. Upload a file to the S3 bucket. 4. Create Custom Error pages. 5. Make the objects public. 6. Create a new Amazon CloudFront distribution. 7. Accessing images through Cloudfront. 8. Configuring custom Error Page 9. Restricting the Geographic Distribution of your content. 10. Validation of the lab. ### Launching the lab environment 1. To launch the lab environment, Click on the **Launch lab** button. 2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision. 3. Once the Lab is started, you will be provided with **IAM user name**, **Password**, **Access** **Key**, and **Secret** **Access** **Key**. You can only start one lab at any given time ## Lab guide ### Lab steps #### Task 1: Sign in to AWS Management Console 1. Click on the **Open console** button, and you will get redirected to AWS Console in a new browser tab. 2. On the AWS sign-in page, * Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab. * Now copy your **User Name** and **Password** in the Lab Console to the **IAM Username and Password** in AWS Console and click on the **Sign in** button. 3. Once Signed In to the AWS Management Console, Make the default AWS Region as **US East (N. Virginia) us-east-1.** #### Task 2: Create S3 Bucket In this task, we are going to create a new S3 bucket in the US East (N. Virginia) region with a unique name enabling ACLs, and allowing public access. 1. Make sure you are in the **US East (N. Virginia) us-east-1** Region. 2. Navigate to the **Services** menu at the top. Click on **S3** in the **Storage** section. 3. In the S3 dashboard, click on the **Create bucket** and fill in the bucket details. * Bucket name: Enter ***whizlabs1234567*** * **Note: S3 Bucket names are globally unique, choose a name that is available.** * Object Ownership: Select **ACLs enabled** option and choose **Object writer** as Object owner * Scroll down to **Block Public Access settings for this bucket** and **Uncheck** the **Block all Public Access** and **acknowledge** the change. * No need to change anything further, just click on the **Create bucket** button. #### Task 3: Upload a file to an S3 bucket 1. Click on the bucket name you just created and you can see that there are no objects created in the bucket. 2. You can upload any image from your local machine or you can download the test image from [Download me](/images/labs/downloads/introduction-to-amazon-simple-storage-service-s3/logo-image.png) 3. To upload a file to our S3 bucket, * Click on the **Upload** button. * Click on **Add files**. * Browse for image we provided and select it. \{**NOTE** : use the same image provided to ignore the validation failure} * Click on the **Upload** button. * You can watch the progress of the upload from within the transfer panel at the bottom of the screen. * Once your file has been uploaded, click on **Close** and you can see an object in the bucket. #### Task 4: Creating Custom Error Pages In this task, we will learn how to create customized error pages for CloudFront. These pages will be displayed in the event that an origin returns an HTTP 4xx or 5xx error. To do this, we must ensure that the error pages are stored in a location that CloudFront can access. In this case, we will use the same S3 bucket that we created previously. 1. To set up a custom error page, access the S3 bucket by clicking on it. 2. Click on **Create Folder** button to create a folder. 3. Enter the folder name as **CustomErrors**. For **Server-side encryption** Select **Specify an encryption key** keep rest things as default. 4. Click on the **Create folder** button. 5. Click on the new **CustomErrors** folder. 6. We will create an **error.html** file: * Create an **error.html** file in your local system using Notepad. * This custom HTML page will be used for showing errors in CloudFront. * Sample **error.html** content: ```

This is Error Page

``` 7. Use the **Upload** button to upload the **error.html** file in the folder. 8. We will create a **block.html** file: * Create a **block.html** file in your local using Notepad. * This custom HTML page will be used for showing geo-restrictions of your content in CloudFront. * Sample **block.html** content: ```

This content is blocked in your location!!!

``` 9. Use the **Upload** button to upload the **block.html** file in the folder. #### Task 5: Making the objects public 1. Navigate back to the bucket and click on the image name. You can see the image details like Owner, size, link, etc. 2. Copy the Object URL and paste it into a new tab. 3. Example: **[https://whizlabs1234567.s3.amazonaws.com/whizlabs\\\_logo\\\_58\\\_32.png](https://whizlabs1234567.s3.amazonaws.com/whizlabs\\_logo\\_58\\_32.png)** * You will see the **AccessDenied** message, meaning the object is not publicly accessible.**whizlabs\_logo\_58\_32.png** 4. Go back to the Bucket and click the **Permissions** tab. 5. Scroll down to the **Bucket Policy** and click on **Edit** button. 6. **Copy and paste** the below policy and save the policy. * **Note**: Change the **name** of the **bucket ARN** with your **bucket ARN** in both the **Resource** option in the code. \{ "Version": "2012-10-17", "Statement": \[ \{ "Effect": "Allow", "Action": \["s3:ListBucket"], "Principal": \{"AWS": "\*"}, "Resource": "\" }, \{ "Effect": "Allow", "Action": \["s3:GetObject", "s3:PutObject"], "Principal": \{"AWS": "\*"}, "Resource": "\/\*" } ] } 7. Open the Image **Object URL** again or refresh the one already open. 8. If you can see your uploaded image in the browser, it means your image is publicly accessible. If not, check your bucket policy again. #### Task 6: Creating a CloudFront Distribution 1. Navigate to **CloudFront** by clicking on the **Services** menu at the top, then click on **CloudFront** in the **Network and Content Delivery** section. 2. Click on **Create a CloudFront distribution** button. 3. Choose a plan: Scroll down and select **Pay as you go** plan and click **Next**. 4. **Distribution name**: Enter the distribution name of your choice. Keep rest as default and click on **Next**. 5. Now Configure distribution as follows: **Specify Origin**: Select **Amazon S3** as Origin type, then click on **Browse S3** and select the bucket you have created. Leave everything as default and click **Next**. 6. In Enable security, choose **Do not enable security protections** under **Web Application Firewall(WAF)** and click **Next**. 7. In **Review and Create**, leave everything as default and click on the **Create distribution** button. 8. You can see that the CloudFront distribution is **enabled** successfully. **Note:** This process will take around 5-10 minutes. 9. The domain name that Amazon CloudFront assigns to your distribution appears in the list of distributions. #### Task 7: Accessing Image through CloudFront Amazon CloudFront is now pointed to Amazon S3 bucket origin and you know that the domain name is associated with the distribution. You can create a link to the image in the Amazon S3 bucket with that domain name. 1. For testing your distribution, copy your domain name and append your image name after the domain name. * **Example: [https://d1jptzlydefk0d.cloudfront.net/whizlabs\\\_logo\\\_58\\\_32.png](https://d1jptzlydefk0d.cloudfront.net/whizlabs\\_logo\\_58\\_32.png)** 2. Open the CloudFront URL in a new tab. You can see your uploaded image. 3. You can see how much faster the CloudFront URL image loads as compared to the S3 URL. When end users request an object using a CloudFront domain name, they are automatically routed to the nearest edge location for high-performance delivery of your content. #### Task 8 : Configuring Custom Error Page 1. Navigate back to **CloudFront Dashboard** and select the **distribution** created. 2. Select the **Error pages** tab. * Click on the **Create custom error response** button. * Now we need to set up our custom error page: * **HTTP Error Code**: Select **404: Not Found** * **Error Caching Minimum TTL**: Enter ***10*** * **Customize Error Response**: Select **Yes** * **Response Page Path**: Enter ***/CustomErrors/error.html*** * **HTTP Response Code**: Select **404: Not Found** * Click on **Create custom error response** button. 3. Navigate back to **Distributions** and wait for your distribution to complete state to change **Deploy.** * **Note**: This process will take around **5-10 minutes.** * Once the state has changed to **Deploy**, you can verify the deployment by checking the Last modified column, it should display the most recent timestamp, indicating the distribution has been updated. After this, proceed to test the error page. * For testing your distribution, copy your domain name and append the name of an image that does not exist in your S3 bucket * Open the **CloudFront URL** in a new tab. 4. If you can see your HTML error page in the browser, it means you successfully set up your custom error page. #### Task 9 : Restricting the Geographic Distribution of Your Content If you need to prevent users in selected countries from accessing your content, you can specify either a whitelist (countries where they can access your content) or a blacklist (countries where they cannot) by using restrictions. 1. On the distribution settings page, select **Security** tab and expand **CloudFront geographic restrictions** click on **Edit** link near Countries. * **Restriction Type:** Select **Block list** * **Select the country where you are currently** and click on it to check this option. * Click on **Save changes** button. 2. Go to the distribution list and wait for your distribution to complete the state changed to **deployed**. * Once the state has been changed to **deployed**, we will test the restriction through CloudFront in the browser. * **Example: [https://d1jptzlydefk0d.cloudfront.net/whizlabs\\\_logo\\\_58\\\_32.png](https://d1jptzlydefk0d.cloudfront.net/whizlabs\\_logo\\_58\\_32.png)** * You can see the following error message: * **403: Error The Amazon CloudFront distribution is configured to block access from your country.** 3. Let us configure a custom error page: * Navigate back to **CloudFront Dashboard** and select the **distribution** you have created. * On the settings page, select **Error pages** tab. * Click on the **Create custom error response** button. * On the settings page, select **Error pages** tab * Now we need to set up our custom error page: * **Http Error Code**: Select **403: Forbidden** * **Error Caching Minimum TTL**: Enter ***10*** * **Customize Error Response**: Select **Yes** * **Response Page Path**: Enter ***/CustomErrors/block.html*** * **HTTP Response Code**: Select **403: Forbidden** * Click on **Create custom error response** button. 4. Navigate back to **Distributions** and wait for your distribution to complete state to change **Deploy.** 5. **Note:** This process will take around 5-10 minutes. 6. Once the state has been changed to **Deploy**, we will test the restriction through CloudFront in the browser. * **Example:** *[https://d1jptzlydefk0d.cloudfront.net/whizlabs\\\_logo\\\_58\\\_32.png](https://d1jptzlydefk0d.cloudfront.net/whizlabs\\_logo\\_58\\_32.png)* 7. If you see the error, this means you successfully configured a custom error page and restricted image access from your country. **Do you know?** Amazon CloudFront allows you to use custom SSL/TLS certificates, including certificates issued by third-party certificate authorities (CAs), to secure your content delivery. However, what makes this even more interesting is that CloudFront also provides an integrated solution called AWS Certificate Manager (ACM) to simplify the process of managing SSL/TLS certificates. #### Task 10: Validation Test 1. Once the lab steps are completed, please click on the **Check my work** button on the left side panel. 2. This will validate the resources in the AWS account and displays whether you have completed this lab successfully or not. 3. Sample output : #### Completion and conclusion 1. You have successfully created an Amazon CloudFront distribution and published an image through CloudFront. 2. You learned how to configure Custom Error Pages for CloudFront Distribution. 3. You learned how to configure restrictions based on Geo-location. 4. You have successfully validated the lab. #### End lab 1. Sign out of AWS Account. 2. You have successfully completed the lab. 3. Once you have completed the steps, click on **End lab** in the IP Lab Portal and wait till the process gets completed. ## What gets checked When you press **Check my work**, the platform verifies each of these: * **Create Public AWS S3 Bucket** — Check whether a Public S3 Bucket created or not * **check s3 object** — Check whether an object is uploaded to the S3 bucket. * **Create CloudFront Distribution** — Check whether a CloudFront Distribution is created and status as Deployed or not. * **Invoke CloudFront Distribution Domain** — Check whether the CloudFront Distribution domain is accessible from the internet or not. * **Create CloudFront Custom Error Page** — Check whether a Custom Error page is created with the path error.html in the CloudFront Distribution or not. ## Related help * [FAQs and Troubleshooting](/aws-cp/support/faqs-and-troubleshooting)