Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Storing data in Amazon's S3. Some of the data is for public viewing, and some is for private.

I'd rather have everything in S3 marked as private, and enforce viewing constraints through my web app. S3's api let's you generate a signed URL to access private data for a limited time.

What I'd like:

  • Public request for
  • CDN Edge server contacts, which 3xx redirects to
  • Future requests for return the cached content from S3
  • At no time, does the actual content pass through, only the redirect
  • Large cache-expire time

For private content, it would be similar, only I'd set the cache-expiration time to be much sooner.

Is something like this possible? How close can I get to this?

share|improve this question
I'm confused. Are you using CloudFront as the CDN? (S3 isn't a CDN) – John Wheal Feb 23 '13 at 13:43

If you're setting up a pull zone, you will able to define the origin server. In this case you wouldn't use at all through your CDN. would be a pull zone for the origin server at and any request to would be first checked for cached content. If the cache is expired or doesn't exist the request would be pulled from your origin server and piped to the end user in one go in a proxied manner.

At no time would your origin URL be exposed to the end user negating the need for you to set up a webapp in the middle or have a 300 redirect.

This is the case with every CDN I've ever used with pull zones.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.