‫So let's go and practice using CloudFront,
‫but first we have to create an S3 bucket
‫to hold our files for our distribution.
‫So let's create a bucket,
‫and I'll call this one demo-cloudfront-stephane-v4.
‫And then we'll scroll down,
‫leave everything as the default,
‫and click on Create bucket.
‫Okay, so my bucket is now created,
‫and I'm going to upload some files in it.
‫So let me add files, and I will choose my three files,
‫beach, coffee, and index.html.
‫So let's upload them.
‫And now they've been uploaded,
‫so if I go in my bucket, we can see all of them.
‫And as a reminder, if I go on index.html,
‫I have two ways of open it.
‫The first one is to use the object URL,
‫but if I try it, I get an access denied
‫because my object is not public.
‫And if I go and click on Open here,
‫this generates a pre-signed...
‫So let's allow popups.
‫This generates a pre-signed URL from my S3 object,
‫which allows me to access the object.
‫So I see I love coffee and Hello world!
‫But I still don't see the image,
‫because the image itself is not public.
‫So let's see how we can instead use CloudFront
‫to make these files accessible
‫without making them public.
‫So let's open up the CloudFront console.
‫And as you can see, on the top right corner,
‫it is a global service,
‫because, well, CloudFront is a global distribution,
‫so there's no region selection.
‫We next have to choose an origin domain.
‫So as you can see, I get my Amazon S3 buckets,
‫or my Elastic Load Balancer, or whatever.
‫So if I choose my bucket,
‫I could choose my demo CloudFront bucket, clicking on here.
‫But here you can enter really any domain name you want,
‫including custom HTTP origins,
‫this is fine.
‫So then the origin access,
‫how do you access the identity?
‫Well, because this is Amazon S3, we have multiple ways.
‫We have public,
‫which is that the bucket itself must be public,
‫but this is not the case for us.
‫Then we have Origin Access Control, which is OAC,
‫that's the recommended way we'll be using it.
‫And here this was OAI,
‫it was the previous way of doing it.
‫But now we're going to use the new way
‫called OAC, Origin Access Control.
‫So we need to create an Origin Access Control,
‫so to do so, let's click on Create control setting,
‫and it just gives us a name for it.
‫So this is good.
‫And let's click on Create.
‫So now this has been created
‫and we will have to update the S3 bucket policy,
‫so that CloudFront can access our S3 bucket.
‫Because if you go right now in here
‫and look at our bucket itself under Permissions
‫and scroll down,
‫the bucket policy is currently empty
‫and so CloudFront will not be able to access it.
‫So right now, we'll leave it as is.
‫I'm going to scroll down and skip many different settings.
‫But one you have to set is the default root object,
‫which is that the default object
‫is going to be for me index.hmtl.
‫Okay, so everything looks good,
‫let's create our distribution.
‫And our distribution can take some time to be created.
‫As you can see here,
‫the S3 bucket policy needs to be updated.
‫So I can click on Copy policy here,
‫and there is a shortcut from here
‫to go straight to your bucket policy settings page.
‫So here we go, we have it.
‫Now let's click on Edit,
‫and we're going to paste the policy we just printed.
‫And by the way, if you somehow lose access to this policy,
‫you can go under Origins.
‫Then in here in Origins,
‫you click on Edit, you scroll down,
‫and here you will find the policy statement
‫to copy and paste here.
‫So if we look at this bucket policy now,
‫we allow the CloudFront service to do GetObject
‫on any file in our bucket,
‫as long as the CloudFront distribution,
‫so this is the condition,
‫is the one we created.
‫So this basically allows our distribution
‫to access our S3 bucket.
‫This is good.
‫This was generated by AWS,
‫we don't do anything besides this.
‫So the permissions are now correct.
‫So back in CloudFront, let's cancel this
‫and we go to our distribution,
‫and we have to wait until it becomes deployed.
‫My CloudFront distribution is now ready,
‫so I'm going to copy the domain name, open a new tab,
‫and as you can see now,
‫I get I love coffee, Hello world!
‫And my image.
‫So you can go to /coffee.jpg,
‫and of course, this will work.
‫And you can go to /beach.jpg,
‫and this will work as well.
‫But the cool thing about it
‫is that now if I refresh this page,
‫this is served actually from the CloudFront cache,
‫and not from the S3 bucket itself.
‫Because well, I requested the file once,
‫so now they are automatically sent by CloudFront.
‫As you can see, the loading is much quicker.
‫And again, if I go to index.html,
‫this is served from the cache.
‫So this is the beauty of CloudFront.
‫Now we've done one request
‫against Amazon S3 through CloudFront,
‫and then the rest is cached on the distribution itself.
‫So if I go back now to CloudFront,
‫on the left-hand side, just to show you,
‫you have the Origin access,
‫and this is where you will find your Origin access controls
‫and we can see that this one was created
‫and is active right now,
‫and is assigned to this distribution.
‫So, okay, that's it,
‫we've seen how CloudFront works.
‫I hope you liked it,
‫and I will see you in the next lecture.