DNS and Content Delivery
Route 53 hosted zones and Resolver, routing policies and query logging, CloudFront distributions, and Global Accelerator: how a name becomes an answer, and how that answer gets served fast.
The previous topics built the network and connected it to other networks. This one starts one layer earlier, at the moment a client turns a name into an address, and follows the request all the way to the edge location that serves it. Four services do that work: Route 53 for naming, Route 53 Resolver for name resolution inside and across a VPC boundary, CloudFront for caching content near viewers, and Global Accelerator for everything CloudFront cannot carry.
What This Topic Covers
- Public and private hosted zones, records and TTL, and when an alias record beats a CNAME (including at the zone apex, where a CNAME is not allowed)
- Private hosted zones end to end: the 2 VPC attributes they depend on, split-view DNS, and the NXDOMAIN behavior that makes a partially populated zone break names it does not define
- The VPC Resolver at VPC+2, plus inbound and outbound Resolver endpoints and the forwarding rules that make hybrid DNS work in each direction
- Public DNS query logging against Resolver query logging: what each captures, where the log has to live, and why caching makes both undercount
- Route 53 health checks: endpoint, calculated, and CloudWatch alarm types, and the 18% aggregation rule
- All 8 routing policies, with real attention to the 3 that all claim to route by location and use different inputs to do it
- CloudFront distributions: cache behaviors and their first-match ordering, the cache key, the Minimum, Maximum, and Default TTL interactions with Cache-Control, and invalidation against versioned file names
- Serving CloudFront on your own domain over HTTPS, and locking an S3 origin down with origin access control
- Global Accelerator: static anycast IP addresses, listeners, endpoint groups, traffic dials, endpoint weights, and the boundary that separates it from CloudFront
Why It Matters
Exam Task 5.2 is named "configure domains, DNS services, and content delivery," and its 3 skills line up almost exactly with these lessons: Resolver configuration, routing policies and query logging, and CloudFront plus Global Accelerator. Skill 5.3.3 comes back to CloudFront caching problems in the troubleshooting topic later in this domain.
The questions here are rarely definitional. They give you one constraint and expect the constraint to eliminate most of the options: a UDP protocol removes CloudFront, a zone apex removes CNAME, a compliance boundary removes latency routing, a Minimum TTL above zero explains stale personalized content, and an ACM certificate outside us-east-1 explains why a custom domain will not attach. Each of those is a single rule, and each corresponds to a real incident that costs someone an afternoon.