CloudFront vs Global Accelerator
Amazon CloudFront and AWS Global Accelerator both bring users onto the AWS global network at an edge location near them, which is why exam questions put them side by side. The difference is what happens next: CloudFront is a content delivery network that caches HTTP and HTTPS content at the edge, while Global Accelerator gives your application fixed anycast IP addresses and carries TCP and UDP traffic to healthy endpoints in one or more Regions, without caching anything.
This page turns that into a decision table, a side-by-side comparison and the traps that show up in SAA-C03 and ANS-C01 questions, including where Route 53 latency routing and S3 Transfer Acceleration fit in. Both services are on the official in-scope lists for both exams.
Reviewed against the AWS documentation
At a glance
Amazon CloudFront
A content delivery network. It caches static and dynamic web content at edge locations close to viewers and fetches from your origin when the edge does not have it.
- Caching images, scripts, video and whole websites close to global viewers
- HTTP and HTTPS APIs and sites, including WebSocket connections
- Private content with signed URLs or cookies, and AWS WAF at the edge
AWS Global Accelerator
A networking service that gives your application static anycast IP addresses at the AWS edge and routes traffic over the AWS global network to the best healthy endpoint in one or more Regions.
- TCP and UDP applications such as gaming, IoT and VoIP
- Fixed IP addresses that clients and firewalls can allowlist once
- Fast multi-Region failover and traffic shifting with no client changes
Which one does the question want?
| If the question says | Pick | Why |
|---|---|---|
| Cache images, video and static website files close to users around the world | CloudFront | CloudFront serves cached copies from the edge location with the lowest latency and only goes to the origin when the edge does not have the file. Docs |
| A multiplayer game uses UDP and needs lower latency and jitter for players worldwide | Global Accelerator | Global Accelerator listeners support TCP and UDP and route players to the nearest healthy endpoint over the AWS global network. Docs |
| Partners must allowlist a small fixed set of IP addresses, and the backend runs in several Regions | Global Accelerator | An accelerator gets two static IPv4 addresses (four with dual-stack) that stay the same while you add or remove Regional endpoints behind them. Docs |
| Move users to another Region right away when the primary Region fails, without changing DNS | Global Accelerator | Health checks run continuously, and new connections go to a healthy endpoint in the next closest Region while the static IPs stay the same. Docs |
| Drain most traffic away from one Region during an upgrade, without touching clients | Global Accelerator | A traffic dial sets what percentage of the traffic already headed to a Regional endpoint group that group accepts; the rest goes to other Regions. Endpoint weights split traffic inside a group. Docs |
| Only paying subscribers may download videos stored in a private S3 bucket | CloudFront | CloudFront signed URLs and signed cookies control who can access content, and origin access control keeps the bucket itself private. Docs |
| Block SQL injection and bad bots before requests reach a global website | CloudFront | You can associate an AWS WAF web ACL with a CloudFront distribution. An accelerator is not a resource that AWS WAF protects. Docs |
Side by side
Exam traps
Picking CloudFront for a UDP or non-HTTP application
CloudFront serves HTTP and HTTPS (WebSocket included). When the scenario mentions UDP, gaming, VoIP or another non-HTTP protocol, Global Accelerator is the edge service that fits, because its listeners take TCP and UDP.
AWS docsExpecting Global Accelerator to cache content
Global Accelerator terminates the TCP connection at the edge and opens a new one to your endpoint, so every request still reaches your application. If the requirement is to offload repeat requests for the same files, the answer is CloudFront.
AWS docsAssuming "static IP" always means Global Accelerator
CloudFront can also give you Anycast static IP lists: 21 addresses for allowlisting with network providers, or 3 to point an apex domain at a distribution. You request them through CloudFront support (the review can take up to two days), and the distribution must use the all edge locations price class. Global Accelerator is still the answer when fixed IPs front Regional TCP or UDP endpoints with health-based failover between Regions.
AWS docsChoosing Route 53 latency routing when the question wants instant failover behind fixed IPs
Route 53 latency records answer DNS queries with the Region that gives the user the lowest latency, so a change of Region means a new DNS answer. Global Accelerator keeps the same static IPs and moves new connections to healthy endpoints behind them.
AWS docsMissing S3 Transfer Acceleration for long-distance uploads to one bucket
If users around the world upload large files to a single S3 bucket, the usual answer is S3 Transfer Acceleration. It uses CloudFront edge locations and then an optimized path to S3, and you turn it on for the bucket.
AWS docs
Practice it
Frequently Asked Questions
What is the difference between CloudFront and Global Accelerator?
CloudFront is a content delivery network: it caches HTTP and HTTPS content at edge locations and serves repeat requests from there. Global Accelerator does not cache. It gives your application static anycast IP addresses and carries TCP or UDP traffic over the AWS global network to the best healthy endpoint, which suits non-HTTP apps, fixed-IP allowlisting and fast multi-Region failover.
CloudFront vs Global Accelerator: which one should I pick on the exam?
Pick CloudFront when the question mentions caching, static assets, video, signed URLs, or AWS WAF in front of a website. Pick Global Accelerator when it mentions UDP or other non-HTTP traffic, static IP addresses for allowlisting, or instant Regional failover without DNS changes.
Does Global Accelerator cache content?
No. Global Accelerator terminates client connections at the edge and opens new ones to your endpoints, so it speeds up the network path but does not store responses. Use CloudFront when you want repeat requests served from the edge.
Does CloudFront have static IP addresses?
A distribution is normally reached through its domain name. You can also get Anycast static IP lists, for example 21 addresses for allowlisting or 3 to route an apex domain, and use them with one or more distributions. You request them through CloudFront support engineering (the review can take up to two days), and the distribution must use the all edge locations price class.
Which exams test CloudFront vs Global Accelerator?
Both services are on the official in-scope service lists for SAA-C03 (Solutions Architect Associate) and ANS-C01 (Advanced Networking Specialty). Expect them in questions about global performance, static IPs, DDoS protection and multi-Region failover.