Module 13: Architecting for the Edge

Advanced Architecting on AWS

CloudFront • Lambda@Edge • Local Zones • Wavelength • IoT

🎯 Module Objectives

Design CloudFront distributions with behaviors and OAC
Compare CloudFront Functions vs. Lambda@Edge
Understand Local Zones and Wavelength for ultra-low latency
Deploy edge computing with AWS Outposts
Implement IoT Greengrass for edge device processing

🌐 Amazon CloudFront

600+ Edge Locations: Global content delivery network
Behaviors: Path-based rules (e.g., /api/* → ALB, /static/* → S3)
Origin Access Control (OAC): Restricts S3 access to CloudFront only (replaces OAI)
Cache policies: Control what's cached (headers, cookies, query strings)
Origin failover: Primary + secondary origin for high availability
Field-level encryption: Encrypt specific POST fields at the edge

OAC vs. OAI: OAC is the modern replacement — supports SSE-KMS, all S3 features, and is recommended for all new distributions. OAI is legacy.

⚡ CloudFront Functions vs. Lambda@Edge

Feature	CloudFront Functions	Lambda@Edge
Runtime	JavaScript only	Node.js, Python
Execution time	<1 ms	Up to 5s (viewer) / 30s (origin)
Memory	2 MB	128–10,240 MB
Network access	No	Yes
Trigger points	Viewer request/response only	All 4 trigger points
Scale	Millions of RPS	Thousands of RPS
Use case	URL rewrites, header manipulation, redirects	A/B testing, auth, image resize, origin selection
Cost	1/6th the cost of Lambda@Edge	Higher (Lambda pricing)

📍 Local Zones & Wavelength

Local Zones

AWS infrastructure in metropolitan areas. Single-digit ms latency to nearby users. EC2, EBS, ECS, EKS available. Connected to parent Region.

Wavelength Zones

AWS compute inside 5G telecom networks. Ultra-low latency for mobile/IoT. EC2, EBS available. Accessed via carrier gateway.

Local Zones: Gaming, media, real-time applications (general low-latency)
Wavelength: Connected vehicles, AR/VR, live video streaming (5G-specific)
Outposts: On-premises (data residency, local processing)

🌿 AWS IoT Greengrass

Purpose: Extend AWS to edge devices (factories, vehicles, sensors)
Components: Lambda functions, ML models, connectors running on local devices
Local compute: Process data locally without round-trip to cloud
Sync: Synchronize with AWS cloud when connectivity is available
Device shadows: Virtual representation of device state
Use cases: Predictive maintenance, local inference, industrial automation

Greengrass positioning: For IoT edge processing (sensors, industrial). Outposts for enterprise server workloads. Local Zones for user-facing low-latency apps. Each solves a different "edge" problem.

💻 Demo: CloudFront with OAC

# Create Origin Access Control
aws cloudfront create-origin-access-control \
  --origin-access-control-config '{"Name":"MyOAC",
    "SigningProtocol":"sigv4","SigningBehavior":"always",
    "OriginAccessControlOriginType":"s3"}'

# Create CloudFront invalidation
aws cloudfront create-invalidation \
  --distribution-id E1234567890 \
  --paths "/*"

# List CloudFront distributions
aws cloudfront list-distributions \
  --query 'DistributionList.Items[].{Id:Id,Domain:DomainName,Status:Status}'

🧪 Knowledge Check

Q1: A website needs to add security headers (X-Frame-Options, CSP) to all responses at minimal cost and maximum scale. What should they use?

A) Lambda@Edge viewer response B) CloudFront Functions viewer response C) ALB response headers D) WAF custom rules

B) CloudFront Functions viewer response — Adding static headers is a simple, lightweight operation perfect for CF Functions (sub-ms execution, 1/6th cost of Lambda@Edge, scales to millions of RPS). No network access needed.

Q2: A mobile gaming company needs <5ms latency for players connected via 5G networks. Which AWS service should they use?

A) CloudFront B) Local Zones C) Wavelength Zones D) Global Accelerator

C) Wavelength Zones — Wavelength embeds compute within 5G carrier networks, providing ultra-low latency (<5ms) for mobile users. Traffic never leaves the carrier network for the compute hop.

📝 Module 13 Summary

CloudFront

600+ PoPs. Behaviors for path routing. OAC (not OAI). Cache/Origin request policies. Origin failover.

Edge Compute

CF Functions (simple, fast, cheap). Lambda@Edge (complex, network access). Choose by complexity.

Extended Infrastructure

Local Zones (metro low-latency). Wavelength (5G). Outposts (on-premises). IoT Greengrass (devices).

Decision Guide

Web content → CloudFront. Metro apps → Local Zones. 5G mobile → Wavelength. Data center → Outposts.