CloudFront and platform program

Situation

Users in growth markets were distant from a single origin. Cache policies had accumulated over incidents. Origin failure became a customer incident. Data transfer had become a line item finance could see and engineering could not explain.

Approach

CloudFront, WAF and Shield were rebuilt as one design, with observability on hit ratio, origin health and cost.

1. Cache key and policy redesignHit ratio recovered without serving stale or incorrect responses. Compression and TTLs matched content types instead of a single inherited rule.
2. Origin groups and failoverA second origin became a designed path, not a runbook. Failover was tested, not assumed.
3. Protection aligned to the entry pointWAF and Shield were tuned to the actual threat and traffic shape. Default configuration was no longer treated as a posture.
4. Transfer as architecturePath changes that reduced the bill without restoring latency. FinOps and edge work, on the same program.

Result

Users received a faster product in the markets that determined growth. Origins could fail without taking the service down. Transfer cost was brought back under control.