CloudFront CDN & SSL

Why Use Amazon CloudFront with S3?

While you can serve media directly from an Amazon S3 bucket URL, pairing S3 with Amazon CloudFront provides three massive architectural advantages:

• Global Edge Performance: Media files are cached at over 600+ CloudFront edge locations worldwide, slashing round-trip latency to under 25ms.
• Free Custom Domain SSL: Serve all media from your own branded URL (e.g. https://media.yourdomain.com/...) backed by a free AWS Certificate Manager (ACM) SSL certificate.
• Lower AWS Egress Costs: AWS offers a perpetual free tier of 1TB data transfer out per month from CloudFront, and data transfer from S3 to CloudFront is 100% free.

Step 1: Create the CloudFront Distribution

1. Open the CloudFront Console and click Create distribution.
2. Origin domain: Select your S3 bucket from the dropdown (e.g. your-media-bucket-name.s3.us-east-2.amazonaws.com).
3. Origin access: Select Origin access control settings (recommended). Click Create control setting and accept defaults.
4. Viewer protocol policy: Select Redirect HTTP to HTTPS.
5. Allowed HTTP methods: Select GET, HEAD, OPTIONS.
6. Cache policy: Select CachingOptimized (provides gzip & Brotli compression automatically).

Step 2: Attach Custom Domain (CNAME) and SSL

1. Under Alternate domain name (CNAME), add your desired subdomain (e.g. media.yourdomain.com).
2. Under Custom SSL certificate, click Request certificate via AWS Certificate Manager (ACM). Note: ACM certificates for CloudFront must be requested in the us-east-1 (N. Virginia) region.
3. Validate the certificate via DNS CNAME in your DNS provider (Cloudflare, Route 53, etc.).
4. Select the validated certificate in CloudFront and click Create distribution.

Step 3: Point Your DNS Record

In your DNS manager (e.g. Cloudflare or Route 53), add a CNAME record pointing your custom domain to your CloudFront distribution domain:

Type:   CNAME
Name:   media
Target: d123456abcdef8.cloudfront.net
TTL:    Auto / 300

Step 4: Enable in Clockwork Offloader

Once your distribution is active, navigate to Settings → Clockwork Offloader → Settings:

1. Enter your custom domain in the Custom Domain / CloudFront URL field: media.yourdomain.com.
2. Check Deliver Media from CloudFront / Custom Domain.
3. Click Save Settings.