tag: Cloudfront · 6 items
- Platform/SRE — Plan: New GA capability worth evaluating this quarter: enabling automatic SDK integration on existing CloudFront web ACLs that use Bot Control (targeted), ATP, or ACFP rule groups eliminates per-application script-tag maintenance and reduces misconfiguration risk. Review your WAF web ACLs and enable the setting via Console, CLI, CDK, or CloudFormation.
- CI/CD — Skip
- Leader — Learn: This reduces recurring per-application engineering overhead for teams protecting many CloudFront-fronted properties with advanced WAF rule groups — useful context when assessing operational cost of the WAF managed-rule investment, but no strategic decision is required.
- Platform/SRE — Plan: If your org has IPv6 compliance or architecture requirements, you can now route IPv6 traffic end-to-end through CloudFront to private ALB/NLB/EC2 origins without exposing them publicly. Evaluate updating VPC origin configs to dual-stack in your next architecture review.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: This GA capability changes how serverless web apps can be architected on AWS — Lambda Web Functions can now sit behind CloudFront for edge TLS, caching, DDoS protection, and WAF, with OAC locking down direct access. Worth evaluating for teams running Lambda-based web workloads this quarter.
- CI/CD — Skip
- Leader — Learn: New AWS capability that shifts the serverless-plus-CDN architecture picture — Lambda Web Functions are now a first-class CloudFront origin — but no pricing change, licensing impact, or forced migration means no decision is pending.
- Platform/SRE — Learn: If your team uses CloudFront flat-rate plans, you can now automate subscription management via CloudFormation/CDK instead of manual console steps — useful for IaC-driven workflows but no operational change required today.
- CI/CD — Skip
- Leader — Plan: If the org is evaluating CloudFront flat-rate plans for cost predictability, API-driven subscription management now makes it viable to automate within IaC pipelines — worth assessing during the next cloud cost review cycle.
- Platform/SRE — Plan: If you use S3 MRAP with CloudFront, you can now drop the Lambda@Edge workaround for SigV4a signing and let CloudFront handle OAC natively — plan to migrate existing custom auth header functions to simplify the architecture.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: New GA capability that consolidates CloudFront Function decisions (A/B variants, auth outcomes, routing) directly into access log records, eliminating cross-system correlation with CloudWatch Logs. Worth adopting in existing CloudFront Functions this quarter by replacing or augmenting console.log() with cf.logCustomData().
- CI/CD — Skip
- Leader — Skip