# How to use CloudFront with object storage buckets

Source: https://docs.quake.ai/docs/object/how-to/use-cloudfront-with-buckets
Markdown: https://docs.quake.ai/docs/object/how-to/use-cloudfront-with-buckets.md

---

# How to use CloudFront with object storage buckets



For Cloudflare, Bunny.net, Fastly, and other CDN providers, start with [How to put a CDN in front of a Quake AI workload](/docs/network/how-to/front-with-cdn). This guide covers AWS CloudFront.



Configure a Quake AI bucket as a CloudFront custom origin to cache objects at AWS edge locations.

## Prerequisites

- A Quake AI object storage bucket with an object to test
- Your Quake AI tenant ID and bucket name
- [S3 credentials](/docs/object/how-to/create-s3-credentials) that can update the bucket policy
- An AWS account with permission to create a CloudFront distribution

## Make the bucket readable by CloudFront

CloudFront treats the Quake AI S3-compatible endpoint as a custom origin. Start by applying the [public read bucket policy](/reference/object-storage/bucket-policies#public-read). You can restrict direct origin access after the distribution works.

Test the tenant-prefixed object URL before you configure CloudFront:

```bash
curl -I "https://object.REGION.rumble.cloud/TENANT_ID:BUCKET_NAME/OBJECT_KEY"
```

Expect a `200 OK` response.

## Create the CloudFront distribution

1. In the AWS console, open **CloudFront** and choose **Create distribution**.
2. Under **Origin**, enter your regional Quake AI object storage hostname in **Origin domain**. For example, use `object.us-east-1.rumble.cloud`. Enter the hostname without `https://`.
3. Select **HTTPS only** for **Protocol**.
4. Set **Origin path** to `/TENANT_ID:BUCKET_NAME`. Do not add a trailing slash.
5. Configure the default cache behavior for the methods and cache policy your objects require. `GET` and `HEAD` cover static downloads.
6. Choose **Create distribution**, then wait for the distribution status to become **Deployed**.

CloudFront appends each viewer request path to the origin path. A request for `/photo.jpg` becomes:

```text
https://object.us-east-1.rumble.cloud/TENANT_ID:BUCKET_NAME/photo.jpg
```

## Verify the distribution

Request the same object through the CloudFront domain:

```bash
curl -I "https://DISTRIBUTION_DOMAIN/OBJECT_KEY"
```

Expect `200 OK`. The `X-Cache` response header reports whether CloudFront served a cached response or fetched the object from the origin. Repeat the request to check for a cache hit.

## Restrict direct origin access

After the distribution works, add a custom origin header in CloudFront and require the same value in the bucket policy. CloudFront overwrites a viewer-supplied header with the configured value before it sends the origin request.



The custom header acts as a shared secret. Store it outside source control, rotate it if exposed, and use a random value. CloudFront origin access control applies to Amazon S3 origins and cannot sign requests to the Quake AI custom origin.



Replace `$tenant`, `$bucket`, and `ORIGIN_HEADER_VALUE` in this policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudFrontReadGetObject",
      "Principal": "*",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3::$tenant:$bucket/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:Referer": "ORIGIN_HEADER_VALUE"
        }
      }
    }
  ]
}
```

Apply the policy with your S3-compatible client. In the CloudFront distribution:

1. Edit the Quake AI origin.
2. Under **Add custom header**, set **Header name** to `Referer`.
3. Set **Value** to the value in the bucket policy.
4. Save the origin and wait for the distribution status to return to **Deployed**.

Verify that the CloudFront URL still returns `200 OK`. A direct request to the tenant-prefixed origin URL without the header should return `403 Forbidden`.

If viewers need time-limited access, configure [CloudFront signed URLs](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-urls.html). Signed URLs control viewer access to CloudFront, while the custom origin header controls direct access to the bucket.

## Use origin failover during a migration

To keep a legacy object store available during migration, create a second CloudFront origin and place both origins in an [origin group](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/high_availability_origin_failover.html). Set the Quake AI bucket as the primary origin and the legacy store as the secondary origin. CloudFront sends eligible read requests to the secondary origin when the primary returns a configured failure status.

## See also

- [How to host a static site on object storage](/docs/object/how-to/host-static-site)
- [How to grant access control on an object storage bucket](/docs/object/how-to/grant-access-control)
- [AWS CloudFront origin settings](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html)
- [AWS CloudFront custom origin headers](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/add-origin-custom-headers.html)