We have an app that is going to store and serve up a decent amount of data in S3 to a global audience where latency should be minimized. So, we've been doing tests with Amazon CloudFront and have seen favorable results.

However, we need a thin middleware layer (to do security etc.) and we'd like to put that in EC2. Due to security restrictions, this middleware layer will do the file streaming from S3/CloudFront:

S3/CloudFront -> EC2 -> Clients

We can geographically distribute the EC2 nodes (US East/West, and Ireland) but the problem is that a client in the EU would hit our US server and be fed data from there, thus rendering much of the performance benefit of CloudFront moot. I've been digging through the EC2 docs but I can't find a built-in way to get a geographically distributed version of EC2 a la CloudFront.

Elastic Load Balancing sounds like the way to go, but I can't seem to find a way with that to direct based on routing... Preferably, we'd like to keep the amount of stuff outside of EC2/S3/etc. to a minimum (for obvious reasons).

Any ideas how to do that within the EC2/S3 framework? DNS/routing tricks?


up vote 4 down vote accepted

Using a middle layer usually negates the benefits of a distributed CDN, as you will only have a few nodes in large central data centers serving the content instead of many edge-cache nodes. If your plan truly requires piping the content through a server first then skip CloudFront and just stick with S3, as you will not get any benefits from it.

A better approach is to formalize what you mean by "security etc." and see if you can get away with using the Authentication and Access Controls that are built into the CDN. S3 and Cloudfront use signatures to provide extensive control over who can access the content, and you can even create time limited URLS that will expire after a few hours or minutes. These special urls can be created by your website so that users can't deep link to the content or share the link with someone else, and usually provide good enough security that still lets you benefit from edge caching.

I am not very familiar with the Amazon documentation, but Windows Azure also has the concept of Shared Access Signatures that let you delegate permissions for uploading or downloading without ever releasing your private keys. There was a recent Cloud Cover episode on Channel 9 that does a great job of describing how to create shared access signatures and how they can be used to secure content and delegate permissions on a CDN.

  • 1
    Just read the AWS newsletter sent out this morning and found that CloudFront offers what they call "Private Content" for controlling who has access to the data. More details about how to setup private content can be found here: docs.amazonwebservices.com/AmazonCloudFront/latest/… – Greg Bray Apr 14 '10 at 16:33

You can use a DNS service which supports routing requests based on a user's country to a different server, but there is probably no point in using Cloudfront if you're serving data from EC2, and from the looks of it no point in using S3 either, since you're always sending the data from your EC2 instance.

Perhaps if you offered more info on what sort of data you're sending out a better solution might become visible.

  • There are other benefits to using S3 that we'd like to maintain, so it's not as crazy as it would seem. Other stuff will be feeding the S3 pool with data... It's only the retrieval that needs this security layer. – Matt Rogish Apr 13 '10 at 18:32

You can deploy a global load balancing solution where geographic proximity is used to direct clients (via DNS answers) to closest data-center. There are software solutions you can run in the cloud (in your case EC2) such as Zeus GLB. You can even grab free evaluation and test it in your environment.

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.