CloudFront vs Global Accelerator: when to use each

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

1. A company must publish two fixed IP addresses to enterprise customers who allow-list destinations in their firewalls, and must still route each customer to the nearest of three Regional deployments behind Network Load Balancers. A solutions architect must pick the front door. Which solution meets these requirements?

   Right. In the game that’s Renown for your Design High-Performing Architectures building.

   Not that one: B is right. In the game your Design High-Performing Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Amazon Route 53 latency routing, which returns the nearest Region's load balancer address to each customer.Latency routing hands out the address of whichever Region is nearest, so the set of destinations a customer must allow-list changes with the answer.The answerB.AWS Global Accelerator, with two static anycast IPv4 addresses in front of Regional endpoints.Static addressing plus Regional routing is the pairing Global Accelerator exists for. On the addresses: "By default, Global Accelerator provides you with static IP addresses that you associate with your accelerator. The static IP addresses are anycast from the AWS edge network. For IPv4, Global Accelerator provides two static IPv4 addresses."Your answerC.Amazon CloudFront, which publishes a fixed set of edge IP addresses that customers can allow-list.CloudFront's edge addresses come from published ranges that change over time, and it is an HTTP distribution rather than a front door for arbitrary TCP endpoints.Your answerD.An Elastic IP address in each Region, published to customers with instructions to fail over between them.Publishing three addresses moves failover into each customer's client and configuration, and the addresses still change if a Region is rebuilt.

   Show the full explanation and doc quotes

   On the routing: "Global Accelerator uses the AWS global network to route traffic to the optimal regional endpoint based on health, client location, and policies that you configure", where "endpoints for standard accelerators can be Network Load Balancers, Application Load Balancers, Amazon EC2 instances, or Elastic IP addresses that are located in one AWS Region or multiple Regions." One pair of addresses for the customer, three Regions behind it.

   Written from docs.aws.amazon.com/global-accelerator/latest/dg/what-is-global-accelerator.html

2. A multiplayer game server accepts UDP traffic from players worldwide and runs behind Network Load Balancers in three Regions. Players in distant Regions see high and variable latency over the public internet. A solutions architect must choose between Amazon CloudFront and AWS Global Accelerator to improve it. Which approach will meet these requirements?

   Right. In the game that’s Renown for your Design High-Performing Architectures building.

   Not that one: D is right. In the game your Design High-Performing Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Amazon CloudFront, because its edge locations terminate connections close to players and cache the game's responses.Picks the edge network that suits cacheable HTTP. Game traffic is UDP and per-player, so there is nothing to cache and the protocol does not fit.Your answerB.Amazon CloudFront with a custom origin per Region, as origin failover then covers losing a Regional deployment.Origin failover is a genuine CloudFront feature and does not change the protocol mismatch: the distribution still serves HTTP requests.Your answerC.Neither service, because UDP traffic must reach the Regional load balancers directly from each player's client.Concludes that nothing helps, when Global Accelerator's documented endpoint types include the Network Load Balancers already in place.The answerD.AWS Global Accelerator, because it fronts Network Load Balancer endpoints and carries the traffic over the AWS global network.Both services put AWS's edge between the player and the Region, and the protocol and endpoint type decide which applies. Global Accelerator's documented endpoints are infrastructure rather than web content: "Endpoints for standard accelerators can be Network Load Balancers, Application Load Balancers, Amazon EC2 instances, or Elastic IP addresses that are located in one AWS Region or multiple Regions"

   Show the full explanation and doc quotes

   And "Global Accelerator directs traffic over the AWS global network to endpoints in the nearest Region to the client." The traffic enters at the nearest edge and travels AWS's backbone rather than the public internet, which is the variability the players are seeing. CloudFront is a content delivery network for HTTP, with nothing to cache here.

   Written from docs.aws.amazon.com/global-accelerator/latest/dg/what-is-global-accelerator.html

3. An application behind a Global Accelerator standard listener keeps session state in memory on each endpoint. Users opening several connections from one machine are served by different endpoints and lose their session, and the listener is on its default affinity setting. Users need to keep their session across all of their connections. Which approach will meet these requirements?

   Right. In the game that’s Renown for your Design High-Performing Architectures building.

   Not that one: A is right. In the game your Design High-Performing Architectures building would lose a little Renown, and this question would come back later.

   The answerA.Set client affinity to source IP, because the default hashes the full five-tuple and a new source port changes the result.The default deliberately spreads connections. "By default, client affinity for a standard listener is set to None and Global Accelerator distributes traffic equally between the endpoints in the endpoint groups for the listener", and it does so because "Global Accelerator uses the 5-tuple properties - source IP, source port, destination IP, destination port, and protocol - to select the hash value." A second connection from the same machine has a different source port and therefore a different hash. The alternative narrows the input: "Global Accelerator uses the 2-tuple properties - source IP and destination IP - to select the hash value and route the user to the same endpoint whenever they connect."Your answerB.Leave affinity at its default and add sticky sessions on the endpoint load balancer, because affinity governs Regions rather than endpoints.Affinity does apply to endpoint selection, so this leaves the cause in place.Your answerC.Set client affinity to source IP, because the default routes each connection to the endpoint group with the most available capacity.Right change, wrong reason: the default distributes by hash rather than by capacity.Your answerD.Leave affinity at its default and reduce the endpoints, because the hash spreads across them.Fewer endpoints reduces the symptom by luck rather than addressing the hash.

   Written from docs.aws.amazon.com/global-accelerator/latest/dg/about-listeners-client-affinity.html