Situation & goal
Design a multi-region, highly available static website served via CDN (CloudFront) with near-zero downtime deploys, safe cache invalidation, and easy rollbacks.
High-level architecture
- Multi-region S3 buckets (one per region) as canonical origins, enabled with Versioning and server-side encryption.
- CloudFront distribution in front of origins using an Origin Group (primary + secondary) or multiple origins with Lambda@Edge for origin selection.
- Route53 latency-based or weighted records pointing to CloudFront (or to two CloudFront distributions for blue/green).
Object versioning & build practice
- Produce immutable, content-hashed filenames for all static assets (e.g., app.abc123.js). Store artifacts in S3 under /releases/{build-id}/.
- Keep index.html (or SPA shell) outside long-term immutable pattern and update it to reference new hashed assets during deploy.
Cache-control headers
- Immutable assets: Cache-Control: public, max-age=31536000, immutable
- Ensures long-lived edge caches without invalidation.
- HTML (index.html): Cache-Control: public, max-age=0, must-revalidate, s-maxage=60
- Short TTL and revalidation ensures clients/edge re-check quickly so new HTML picks up new hashes.
- API/JSON: set appropriate short TTLs.
Safe cache invalidation & deployment strategy
- Primary method: asset fingerprinting avoids invalidation for static files.
- For index.html (small) perform targeted CloudFront invalidation if necessary, but prefer:
- Blue/green: create new CloudFront distribution referencing new S3 prefix /releases/{build-id}/, then shift Route53 weighted traffic (or update ALIAS) from old to new distribution gradually (10% → 50% → 100%) while monitoring metrics.
- Or use CloudFront cache-control s-maxage + conditional GET so most edges fetch up-to-date index quickly.
- Use staged rollout across regions via weighted routing and health checks.
Rollbacks
- If a problem detected, shift Route53 weights back to previous distribution immediately (seconds).
- Because assets are immutable and previous release still present under old prefix, no cache flushing needed; HTML referencing old hashes continues to work.
- If an invalidation was used and caused issues, re-point to previous distribution or re-deploy previous index.html pointing to older hashes.
Monitoring & automation
- Automated CI/CD: build artifacts, upload to /releases/{id}, run integration smoke tests hitting edge locations (via Canary/Health checks).
- CloudWatch/Datadog for 5xx, latency, error budget; alarms trigger rollback automation.
- Keep an audit of invalidations and distribution changes.
Trade-offs
- Blue/green adds cost (two distributions) but allows instant rollback and avoids broad invalidations.
- Fingerprinting requires build tooling and coordinating HTML updates but minimizes CDN churn.
This approach yields near-zero downtime using immutable assets, short-ttl HTML, and blue/green or weighted traffic shifts for safe, fast rollbacks.
