> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CloudFront

> CloudFront APIs with Cloud Adapter.

This page describes how CloudFront maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior.

## Supported environments

* Azure
* DigitalOcean
* Google Cloud

Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available.

## How the backends compare

Each row compares a capability of CloudFront with its adaptation on each backend.
A dash means this profile does not state the capability for that backend.

### Cloud Adapter

| Capability | CloudFront | Azure · Azure Front Door Premium | Azure · Azure Front Door Standard | DigitalOcean | Google Cloud |
| - | - | - | - | - | - |
| Edge network · who serves the traffic | CloudFront's global PoPs | Azure Front Door's global edge | Azure Front Door Standard's global edge | DigitalOcean's CDN edge | Google Cloud CDN on the external load balancer |
| Origins · origin domains → backend | Yes - multiple origins + origin groups with failover | Partial - one origin only; more origins or an origin group stop the build | Partial - one public origin only; more origins or an origin group stop the build | Partial - the first origin's domain becomes the CDN origin; additional origins and origin groups drop and are flagged during the build | Partial - one origin only, as a backend service or bucket; more origins or an origin group stop the build |
| Cache behaviors · paths, TTLs, cache key | Yes - path patterns, per-behavior TTLs, cache key, methods | Partial - default behavior only, with one cache duration; path-based behaviors stop the build | Partial - default behavior only, with one cache duration; path-based behaviors stop the build | Partial - the default behavior's default TTL is preserved; path patterns, min/max TTL, and methods drop and are flagged during the build | Partial - default behavior only, as the backend cache policy; path-based behaviors stop the build |
| Compression · automatic gzip/brotli | Yes - automatic edge compression | Yes - the route's compression setting | Yes - the route's compression setting | Partial - there is no configurable compression setting; DigitalOcean's CDN edge may apply gzip automatically when the client requests it | Yes - the backend's compression mode |
| HTTPS redirect · viewer protocol policy | Yes - redirect-to-https / https-only | Yes - the route's HTTPS-redirect setting | Yes - the route's HTTPS-redirect setting | Partial - the viewer protocol policy has no counterpart; the DigitalOcean CDN endpoint serves over HTTPS by default | Yes - a url\_map HTTPS redirect rule |
| Custom domains + TLS · aliases + certificate | Yes - alternate domain names + ACM viewer certificate | Partial - certificate managed by the backend CDN after domain validation; ACM material and TLS settings require review | Partial - certificate managed by the backend CDN after domain validation; ACM material and TLS settings require review | Partial - the first alias becomes the CDN custom domain; additional aliases drop, and the viewer certificate becomes a DigitalOcean-managed certificate you attach | Partial - certificate managed by the backend CDN after domain validation; ACM material and TLS settings require review |
| WAF / geo restrictions · web ACL + geo | Yes - AWS WAF web ACL + geo restrictions | Partial - custom match, rate-limit and country rules; Microsoft-managed rule selection differs from AWS groups | Partial - custom match, rate-limit and country rules; managed rules and bot protection require Premium | No - no attached-WAF or geo surface on the DigitalOcean CDN endpoint; dropped and flagged during the build | No - Cloud Armor configured separately; no automatic AWS web ACL or geo translation |
| Origin access & signed URLs · origin and viewer authorization | Yes - OAI / OAC + trusted-signer signed URLs | Partial - approved Private Link access to supported origins; viewer signed-URL verification requires a separate application design | Partial - public origin with separate access controls; no Private Link or CloudFront viewer-signature verification | - | Partial - trusted signers stop the build; Cloud CDN signed URLs need a new HMAC signer you set up; origin access is configured separately |
| Edge functions · Lambda\@Edge / Functions | Yes - Lambda\@Edge + CloudFront Functions | No - an association stops the build; re-create header, URL and redirect rules yourself | No - an association stops the build; re-create header, URL and redirect rules yourself | No - no edge-compute analog; associations drop and standalone functions cause a build error | No - no function runtime; an association stops the build |
| API coverage | full | partial | partial | minimal | partial |
| Origin access & signed URLs · locked-down origin | Yes - OAI / OAC + trusted-signer signed URLs | - | - | No - the origin access control companion is removed and flagged during the build; a standalone origin access identity causes a build error | - |

## On Azure

### Azure Front Door Premium

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Origin access (OAI / OAC) | Access control | Partial | Most usage | Premium can connect to a supported origin through an approved Private Link endpoint. Configure the compatible origin and close unwanted alternate access paths. A standalone origin access identity without a supported translation causes a build error |
| Signed URLs & trusted keys | Access control | Out of scope | Most usage | CloudFront signed URLs and signed cookies use RSA or ECDSA signatures that Front Door cannot verify. A behavior with trusted signers or trusted key groups stops the build. |
| WAF & geo restrictions | Access control | Partial | Most usage | Custom match, rate-limit and country rules become WAF rules on the backend CDN, attached through a security policy. Premium supports Microsoft-managed rules and bot protection; AWS managed groups require backend-specific rule selection. |
| Cache behaviors | Cache | Partial | Most usage | Only the default cache behavior is supported. Its HTTPS redirect, compression and query-string setting are kept, and its minimum, default and maximum TTLs collapse to one cache duration, with a reported issue. A distribution with any ordered\_cache\_behavior (path-based routing) stops the build. |
| Content delivery | Content delivery | Supported | Common | served on Azure Front Door: Tensor9 provisions a Front Door profile and endpoint that front your origin, with an origin group and origins pointing at your backend; Microsoft operates the edge |
| DNS cutover | Content delivery | Supported | Common | Supported Route 53 aliases point to the Front Door endpoint. References to the distribution's domain\_name and id are redirected to the endpoint's host name and id. References to arn or hosted\_zone\_id are removed from outputs with a reported issue and stop the build anywhere else. |
| Custom domains + TLS | Domains & TLS | Partial | Most usage | Custom domains use certificates managed by the backend CDN. Complete domain validation before cutover; an ACM ARN supplies no certificate material. Minimum TLS-version and SSL support-method differences are reported. |
| Edge logic (Lambda\@Edge / CloudFront Functions) | Edge logic | Out of scope | Most usage | A Lambda\@Edge or CloudFront Functions association, or field-level encryption, stops the build; Front Door cannot run function code. You can re-create header, URL and redirect behavior as Rules engine rules yourself. Standalone functions also cause a build error. |
| Policy & monitoring facets (cache / origin-request / response-headers policies, monitoring subscription) | Facets | Out of scope | Full surface | these resources are not supported by this mapping; the build reports an error |
| Origins | Origins | Partial | Common | Only a distribution with one origin is supported; that origin becomes the single member of a Front Door origin group. A distribution with more than one origin or an origin group stops the build. Confirm unresolved origin addresses. |

#### How it works

Tensor9 maps your CloudFront distribution to an Azure Front Door Premium profile with an endpoint, an origin group, origins, a route and a rule set. Microsoft operates the edge cache that answers your customers' requests. You control the origin and Front Door's configuration, and Tensor9 is not in the request path.

Your custom domain names keep working once their DNS records and certificates are ready on Front Door. The CloudFront-generated hostname and the objects already in the CloudFront cache do not move. Expect more requests to reach your origin while the new cache fills.

![A request to your custom domain reaches Front Door, which applies the route and cache rules and sends cache misses to a healthy origin in the origin group.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBIHJlcXVlc3QgdG8geW91ciBjdXN0b20gZG9tYWluIHJlYWNoZXMgRnJvbnQgRG9vciwgd2hpY2ggYXBwbGllcyB0aGUgcm91dGUgYW5kIGNhY2hlIHJ1bGVzIGFuZCBzZW5kcyBjYWNoZSBtaXNzZXMgdG8gYSBoZWFsdGh5IG9yaWdpbiBpbiB0aGUgb3JpZ2luIGdyb3VwLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI4MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNjQ3NDhiIi8+PHRleHQgeD0iMTQ0IiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPllvdXIgY3VzdG9tZXJzPC90ZXh0Pjx0ZXh0IHg9IjE0NCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5SZXF1ZXN0IGEgY3VzdG9tIGRvbWFpbjwvdGV4dD48cGF0aCBkPSJNMjY2LDgwIGgyMiBsLTYsLTUgbTYsNSBsLTYsNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz48cmVjdCB4PSIyOTQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiM2NDc0OGIiLz48dGV4dCB4PSI0MTQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+RnJvbnQgRG9vciBQcmVtaXVtPC90ZXh0Pjx0ZXh0IHg9IjQxNCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5Sb3V0ZXMgYW5kIGNhY2hlczwvdGV4dD48cGF0aCBkPSJNNTM2LDgwIGgyMiBsLTYsLTUgbTYsNSBsLTYsNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz48cmVjdCB4PSI1NjQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiM2NDc0OGIiLz48dGV4dCB4PSI2ODQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+T3JpZ2luIGdyb3VwPC90ZXh0Pjx0ZXh0IHg9IjY4NCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5QaWNrcyBhIGhlYWx0aHkgb3JpZ2luPC90ZXh0Pjwvc3ZnPg==)

![A request to your custom domain reaches Front Door, which applies the route and cache rules and sends cache misses to a healthy origin in the origin group.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBIHJlcXVlc3QgdG8geW91ciBjdXN0b20gZG9tYWluIHJlYWNoZXMgRnJvbnQgRG9vciwgd2hpY2ggYXBwbGllcyB0aGUgcm91dGUgYW5kIGNhY2hlIHJ1bGVzIGFuZCBzZW5kcyBjYWNoZSBtaXNzZXMgdG8gYSBoZWFsdGh5IG9yaWdpbiBpbiB0aGUgb3JpZ2luIGdyb3VwLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI4MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojOTRhM2I4Ii8+PHRleHQgeD0iMTQ0IiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPllvdXIgY3VzdG9tZXJzPC90ZXh0Pjx0ZXh0IHg9IjE0NCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5SZXF1ZXN0IGEgY3VzdG9tIGRvbWFpbjwvdGV4dD48cGF0aCBkPSJNMjY2LDgwIGgyMiBsLTYsLTUgbTYsNSBsLTYsNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz48cmVjdCB4PSIyOTQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM5NGEzYjgiLz48dGV4dCB4PSI0MTQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+RnJvbnQgRG9vciBQcmVtaXVtPC90ZXh0Pjx0ZXh0IHg9IjQxNCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5Sb3V0ZXMgYW5kIGNhY2hlczwvdGV4dD48cGF0aCBkPSJNNTM2LDgwIGgyMiBsLTYsLTUgbTYsNSBsLTYsNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz48cmVjdCB4PSI1NjQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM5NGEzYjgiLz48dGV4dCB4PSI2ODQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+T3JpZ2luIGdyb3VwPC90ZXh0Pjx0ZXh0IHg9IjY4NCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5QaWNrcyBhIGhlYWx0aHkgb3JpZ2luPC90ZXh0Pjwvc3ZnPg==)

#### Origins and routing

Front Door's endpoint provides the public hostname. A route connects the endpoint to an origin group and to the rules applied to each request. Each origin host in the distribution becomes an origin in the group, and Front Door uses health probes to choose an available origin. This is not the same as CloudFront origin-group failover, so check how failover and origin selection behave for your traffic.

If the build cannot work out an origin's address, you must confirm it. An S3 origin points at the storage endpoint that the S3 bucket maps to in this deployment. Check the origin host header, TLS and network access against that endpoint; do not keep an AWS-specific address.

#### Origin access

Front Door Premium can reach supported origins through Private Link. Traffic then travels to the origin over a private connection on Microsoft's network, and no connector process runs inside your application cluster. For a Kubernetes service, you provide a compatible Azure Private Link service and load balancer, then approve Front Door's managed private endpoint. Choosing Premium does not by itself make an arbitrary private cluster reachable.

The origin must accept the private traffic, and your platform team must close any public or alternate paths to the origin that you do not want. CloudFront origin access identity (OAI) and origin access control (OAC) authenticate requests to supported origins; OAC is not a private network connection. On Front Door, use the access controls that suit each origin type. Microsoft describes them in [securing Front Door origins](https://learn.microsoft.com/en-us/azure/frontdoor/origin-security).

![Front Door Premium reaches a supported origin through an approved Private Link connection, and the origin checks the request.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJGcm9udCBEb29yIFByZW1pdW0gcmVhY2hlcyBhIHN1cHBvcnRlZCBvcmlnaW4gdGhyb3VnaCBhbiBhcHByb3ZlZCBQcml2YXRlIExpbmsgY29ubmVjdGlvbiwgYW5kIHRoZSBvcmlnaW4gY2hlY2tzIHRoZSByZXF1ZXN0LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI4MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNjQ3NDhiIi8+PHRleHQgeD0iMTQ0IiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPkZyb250IERvb3IgUHJlbWl1bTwvdGV4dD48dGV4dCB4PSIxNDQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+U2VuZHMgb3JpZ2luIHJlcXVlc3Q8L3RleHQ+PHBhdGggZD0iTTI2Niw4MCBoMjIgbC02LC01IG02LDUgbC02LDUiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMiIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+PHJlY3QgeD0iMjk0IiB5PSI0MCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI4MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNjQ3NDhiIi8+PHRleHQgeD0iNDE0IiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPlByaXZhdGUgTGluazwvdGV4dD48dGV4dCB4PSI0MTQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+QXBwcm92ZWQgY29ubmVjdGlvbjwvdGV4dD48cGF0aCBkPSJNNTM2LDgwIGgyMiBsLTYsLTUgbTYsNSBsLTYsNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz48cmVjdCB4PSI1NjQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiM2NDc0OGIiLz48dGV4dCB4PSI2ODQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+T3JpZ2luPC90ZXh0Pjx0ZXh0IHg9IjY4NCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5DaGVja3MgdGhlIHJlcXVlc3Q8L3RleHQ+PC9zdmc+)

![Front Door Premium reaches a supported origin through an approved Private Link connection, and the origin checks the request.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJGcm9udCBEb29yIFByZW1pdW0gcmVhY2hlcyBhIHN1cHBvcnRlZCBvcmlnaW4gdGhyb3VnaCBhbiBhcHByb3ZlZCBQcml2YXRlIExpbmsgY29ubmVjdGlvbiwgYW5kIHRoZSBvcmlnaW4gY2hlY2tzIHRoZSByZXF1ZXN0LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI4MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojOTRhM2I4Ii8+PHRleHQgeD0iMTQ0IiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPkZyb250IERvb3IgUHJlbWl1bTwvdGV4dD48dGV4dCB4PSIxNDQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+U2VuZHMgb3JpZ2luIHJlcXVlc3Q8L3RleHQ+PHBhdGggZD0iTTI2Niw4MCBoMjIgbC02LC01IG02LDUgbC02LDUiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMiIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+PHJlY3QgeD0iMjk0IiB5PSI0MCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI4MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojOTRhM2I4Ii8+PHRleHQgeD0iNDE0IiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPlByaXZhdGUgTGluazwvdGV4dD48dGV4dCB4PSI0MTQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+QXBwcm92ZWQgY29ubmVjdGlvbjwvdGV4dD48cGF0aCBkPSJNNTM2LDgwIGgyMiBsLTYsLTUgbTYsNSBsLTYsNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz48cmVjdCB4PSI1NjQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM5NGEzYjgiLz48dGV4dCB4PSI2ODQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+T3JpZ2luPC90ZXh0Pjx0ZXh0IHg9IjY4NCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5DaGVja3MgdGhlIHJlcXVlc3Q8L3RleHQ+PC9zdmc+)

#### Web application firewall

The distribution's WAF rules go into a Front Door firewall policy, which a security policy attaches to the endpoint. Supported AWS custom match and rate-limit rules become Front Door conditions and actions, and a geographic restriction becomes a country-match rule. An AWS `web_acl_id` only refers to an AWS web ACL; it does not become an Azure policy on its own.

Premium supports Microsoft-managed WAF rule sets and bot protection as well as custom rules. AWS managed rule groups are not the same rule sets: choose the matching Front Door protections and test their effect. The build reports any complex AWS condition that has no matching Front Door expression.

#### Cache behavior

The default and ordered cache behaviors become rules matched by path. A route configuration override sets each rule's cache duration and query-string behavior, and compression is set on the route. Check which query parameters are part of the cache key, especially for personalized responses.

Front Door has one cache duration where CloudFront has minimum, default and maximum TTLs. The default TTL becomes the cache duration, and the build reports the separate minimum and maximum. Forwarded-header lists and allowed-method lists also differ. Check the effective cache key and request handling; do not assume that two requests CloudFront kept apart stay separate.

#### Domains and certificates

Each alias becomes a Front Door custom domain with a certificate that Front Door issues and renews. Front Door does not copy an ACM certificate from its ARN. Complete domain validation and wait until the certificate is ready before you change DNS. The minimum TLS version and SSL support method differ, so check them.

Supported Route 53 aliases are updated to point at Front Door's endpoint, and a reference to the distribution's `domain_name` or `id` now points at the endpoint too. `arn` and `hosted_zone_id` have no Azure equivalent: a reference in an output is removed, and a reference anywhere else causes a build error. Update DNS consumers and allowlists outside the stack yourself.

#### Limitations

Where CloudFront and Front Door Premium differ

* **Edge function code is not supported.** Front Door does not run Lambda\@Edge or CloudFront Functions code. A distribution that associates either causes a build error. Express header changes, URL rewrites and redirects as Front Door rules, and move other logic to a suitable runtime before cutover.
* **CloudFront signed URLs and cookies are not supported.** Front Door cannot check CloudFront's RSA or ECDSA signatures. A cache behavior that uses trusted signers or key groups causes a build error, and viewer authorization needs a separate application design.
* **Field-level encryption is not supported.** A distribution that uses CloudFront field-level encryption causes a build error.
* **TTLs behave differently: one cache duration per rule.** The default TTL becomes the cache duration. Separate minimum and maximum TTLs, including a minimum above the default, are reported and not enforced.
* **Custom error responses behave differently.** A CloudFront custom error response, such as serving `/index.html` for a 404, becomes a URL rewrite applied to the request rather than to the origin's status code. Check your single-page-app routes.
* **Price classes are not supported.** Front Door serves from Azure's own edge locations, so a CloudFront price class is dropped.
* **You must attach policy resources to a distribution.** A standalone cache, origin-request or response-headers policy, a monitoring subscription, or an origin access identity with no supported attachment causes a build error.

#### Other considerations

* **Before going live.** Confirm origin addresses, approve the Private Link connection where you use one, validate each custom domain and wait for its certificate, then change DNS. Check that the origin cannot be reached by a path that bypasses Front Door.
* **What to monitor.** Use Azure Monitor and diagnostic settings for access logs and metrics; an AWS monitoring subscription is not a Front Door setting. After cutover, watch cache hit rate, origin health, latency and errors. Test allowed and blocked requests against the firewall policy.
* **Moving from AWS.** Nothing in the CloudFront cache is copied. Make sure the origin can take the extra load while Front Door's cache fills. Origin data moves through its own service's mapping.

### Azure Front Door Standard

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Origin access & signed URLs | Access control | Partial | Most usage | Standard reaches public origins. Restrict origin network access and validate configured origin headers; a secret header is not private networking. Private Link requires Premium. Existing CloudFront viewer signatures are not verified. |
| Signed URLs | Access control | Out of scope | Most usage | Front Door cannot verify CloudFront's RSA or ECDSA signed URLs and cookies. A behavior with trusted signers or trusted key groups stops the build. |
| WAF / geo restrictions | Access control | Partial | Most usage | Custom match, rate-limit and country rules become WAF rules on the backend CDN, attached through a security policy. Microsoft-managed rules and bot protection require Premium. Unsupported source conditions are reported. |
| Cache behaviors | Cache | Partial | Most usage | Only the default cache behavior is supported. Its HTTPS redirect, compression and query-string setting are kept, and its minimum, default and maximum TTLs collapse to one cache duration, with a reported issue. A distribution with any ordered\_cache\_behavior (path-based routing) stops the build. |
| Content delivery | Content delivery | Supported | Common | served on Azure Front Door Standard: Tensor9 provisions a Front Door Standard profile and endpoint that front your origin, with an origin group and origins pointing at your backend; Microsoft operates the edge |
| DNS cutover | Content delivery | Supported | Common | Supported Route 53 aliases point to the Front Door endpoint. References to the distribution's domain\_name and id are redirected to the endpoint's host name and id. References to arn or hosted\_zone\_id are removed from outputs with a reported issue and stop the build anywhere else. |
| Custom domains + TLS | Domains & TLS | Partial | Most usage | Custom domains use certificates managed by the backend CDN. Complete domain validation before cutover; an ACM ARN supplies no certificate material. Minimum TLS-version and SSL support-method differences are reported. |
| Edge logic (Lambda\@Edge / CloudFront Functions) | Edge logic | Out of scope | Most usage | A Lambda\@Edge or CloudFront Functions association, or field-level encryption, stops the build; Front Door cannot run function code. You can re-create header, URL and redirect behavior as Rules engine rules yourself. Standalone functions also cause a build error. |
| Policy & monitoring facets (standalone cache / origin-request / response-headers policies, monitoring subscription) | Facets | Out of scope | Full surface | a cache, origin-request, or response-headers policy referenced by a behavior is re-expressed in that behavior's route and rules; a standalone policy claimed by no distribution, and the monitoring subscription, have no compiler and cause a build error |
| Origins | Origins | Partial | Common | Only a distribution with one origin is supported; that origin becomes the single member of a Front Door origin group. A distribution with more than one origin or an origin group stops the build. Standard requires a public origin endpoint; a private (OAC-locked) origin stops the build. Confirm unresolved origin addresses. |

#### How it works

Tensor9 maps your CloudFront distribution to an Azure Front Door Standard profile with an endpoint, an origin group, origins, a route and a rule set. Microsoft operates the edge cache that answers your customers' requests. You control the origin and Front Door's configuration, and Tensor9 is not in the request path.

Your custom domain names keep working once their DNS records and certificates are ready on Front Door. The CloudFront-generated hostname and the objects already in the CloudFront cache do not move. Expect more requests to reach your origin while the new cache fills.

![A request to your custom domain reaches Front Door, which applies the route and cache rules and sends cache misses to a healthy origin in the origin group.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBIHJlcXVlc3QgdG8geW91ciBjdXN0b20gZG9tYWluIHJlYWNoZXMgRnJvbnQgRG9vciwgd2hpY2ggYXBwbGllcyB0aGUgcm91dGUgYW5kIGNhY2hlIHJ1bGVzIGFuZCBzZW5kcyBjYWNoZSBtaXNzZXMgdG8gYSBoZWFsdGh5IG9yaWdpbiBpbiB0aGUgb3JpZ2luIGdyb3VwLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI4MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNjQ3NDhiIi8+PHRleHQgeD0iMTQ0IiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPllvdXIgY3VzdG9tZXJzPC90ZXh0Pjx0ZXh0IHg9IjE0NCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5SZXF1ZXN0IGEgY3VzdG9tIGRvbWFpbjwvdGV4dD48cGF0aCBkPSJNMjY2LDgwIGgyMiBsLTYsLTUgbTYsNSBsLTYsNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz48cmVjdCB4PSIyOTQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiM2NDc0OGIiLz48dGV4dCB4PSI0MTQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+RnJvbnQgRG9vciBTdGFuZGFyZDwvdGV4dD48dGV4dCB4PSI0MTQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+Um91dGVzIGFuZCBjYWNoZXM8L3RleHQ+PHBhdGggZD0iTTUzNiw4MCBoMjIgbC02LC01IG02LDUgbC02LDUiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMiIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+PHJlY3QgeD0iNTY0IiB5PSI0MCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI4MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNjQ3NDhiIi8+PHRleHQgeD0iNjg0IiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPk9yaWdpbiBncm91cDwvdGV4dD48dGV4dCB4PSI2ODQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+UGlja3MgYSBoZWFsdGh5IG9yaWdpbjwvdGV4dD48L3N2Zz4=)

![A request to your custom domain reaches Front Door, which applies the route and cache rules and sends cache misses to a healthy origin in the origin group.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBIHJlcXVlc3QgdG8geW91ciBjdXN0b20gZG9tYWluIHJlYWNoZXMgRnJvbnQgRG9vciwgd2hpY2ggYXBwbGllcyB0aGUgcm91dGUgYW5kIGNhY2hlIHJ1bGVzIGFuZCBzZW5kcyBjYWNoZSBtaXNzZXMgdG8gYSBoZWFsdGh5IG9yaWdpbiBpbiB0aGUgb3JpZ2luIGdyb3VwLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI4MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojOTRhM2I4Ii8+PHRleHQgeD0iMTQ0IiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPllvdXIgY3VzdG9tZXJzPC90ZXh0Pjx0ZXh0IHg9IjE0NCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5SZXF1ZXN0IGEgY3VzdG9tIGRvbWFpbjwvdGV4dD48cGF0aCBkPSJNMjY2LDgwIGgyMiBsLTYsLTUgbTYsNSBsLTYsNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz48cmVjdCB4PSIyOTQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM5NGEzYjgiLz48dGV4dCB4PSI0MTQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+RnJvbnQgRG9vciBTdGFuZGFyZDwvdGV4dD48dGV4dCB4PSI0MTQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+Um91dGVzIGFuZCBjYWNoZXM8L3RleHQ+PHBhdGggZD0iTTUzNiw4MCBoMjIgbC02LC01IG02LDUgbC02LDUiIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMiIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+PHJlY3QgeD0iNTY0IiB5PSI0MCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI4MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojOTRhM2I4Ii8+PHRleHQgeD0iNjg0IiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPk9yaWdpbiBncm91cDwvdGV4dD48dGV4dCB4PSI2ODQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+UGlja3MgYSBoZWFsdGh5IG9yaWdpbjwvdGV4dD48L3N2Zz4=)

#### Origins and routing

Front Door's endpoint provides the public hostname. A route connects the endpoint to an origin group and to the rules applied to each request. Each origin host in the distribution becomes an origin in the group, and Front Door uses health probes to choose an available origin. This is not the same as CloudFront origin-group failover, so check how failover and origin selection behave for your traffic.

If the build cannot work out an origin's address, you must confirm it. An S3 origin points at the storage endpoint that the S3 bucket maps to in this deployment. Check the origin host header, TLS and network access against that endpoint; do not keep an AWS-specific address.

#### Origin access

Front Door Standard reaches an origin only through a public endpoint; Private Link origins are not supported. If the origin must have no public endpoint, use Front Door Premium with a compatible Private Link setup.

You must restrict direct access to the public origin. Azure's guidance combines the `AzureFrontDoor.Backend` service tag in network rules with a check of the expected `X-Azure-FDID` header value. The origin can also check a shared secret that Front Door adds as an origin request header; you must protect and rotate that secret. A header check alone does not isolate the network.

CloudFront origin access identity (OAI) and origin access control (OAC) authenticate requests to supported origins; OAC is not a private network connection. On Front Door, use the access controls that suit each origin type. Microsoft describes them in [securing Front Door origins](https://learn.microsoft.com/en-us/azure/frontdoor/origin-security).

![Front Door Standard sends origin requests to a public endpoint. Network rules and request checks at the origin restrict who can reach it.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJGcm9udCBEb29yIFN0YW5kYXJkIHNlbmRzIG9yaWdpbiByZXF1ZXN0cyB0byBhIHB1YmxpYyBlbmRwb2ludC4gTmV0d29yayBydWxlcyBhbmQgcmVxdWVzdCBjaGVja3MgYXQgdGhlIG9yaWdpbiByZXN0cmljdCB3aG8gY2FuIHJlYWNoIGl0LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI4MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNjQ3NDhiIi8+PHRleHQgeD0iMTQ0IiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPkZyb250IERvb3IgU3RhbmRhcmQ8L3RleHQ+PHRleHQgeD0iMTQ0IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPlNlbmRzIG9yaWdpbiByZXF1ZXN0PC90ZXh0PjxwYXRoIGQ9Ik0yNjYsODAgaDIyIGwtNiwtNSBtNiw1IGwtNiw1IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPjxyZWN0IHg9IjI5NCIgeT0iNDAiIHdpZHRoPSIyNDAiIGhlaWdodD0iODAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6IzY0NzQ4YiIvPjx0ZXh0IHg9IjQxNCIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5QdWJsaWMgZW5kcG9pbnQ8L3RleHQ+PHRleHQgeD0iNDE0IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPkFjY2VzcyByZXN0cmljdGVkPC90ZXh0PjxwYXRoIGQ9Ik01MzYsODAgaDIyIGwtNiwtNSBtNiw1IGwtNiw1IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPjxyZWN0IHg9IjU2NCIgeT0iNDAiIHdpZHRoPSIyNDAiIGhlaWdodD0iODAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6IzY0NzQ4YiIvPjx0ZXh0IHg9IjY4NCIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5PcmlnaW48L3RleHQ+PHRleHQgeD0iNjg0IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPkNoZWNrcyB0aGUgcmVxdWVzdDwvdGV4dD48L3N2Zz4=)

![Front Door Standard sends origin requests to a public endpoint. Network rules and request checks at the origin restrict who can reach it.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJGcm9udCBEb29yIFN0YW5kYXJkIHNlbmRzIG9yaWdpbiByZXF1ZXN0cyB0byBhIHB1YmxpYyBlbmRwb2ludC4gTmV0d29yayBydWxlcyBhbmQgcmVxdWVzdCBjaGVja3MgYXQgdGhlIG9yaWdpbiByZXN0cmljdCB3aG8gY2FuIHJlYWNoIGl0LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI4MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojOTRhM2I4Ii8+PHRleHQgeD0iMTQ0IiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPkZyb250IERvb3IgU3RhbmRhcmQ8L3RleHQ+PHRleHQgeD0iMTQ0IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPlNlbmRzIG9yaWdpbiByZXF1ZXN0PC90ZXh0PjxwYXRoIGQ9Ik0yNjYsODAgaDIyIGwtNiwtNSBtNiw1IGwtNiw1IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPjxyZWN0IHg9IjI5NCIgeT0iNDAiIHdpZHRoPSIyNDAiIGhlaWdodD0iODAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6Izk0YTNiOCIvPjx0ZXh0IHg9IjQxNCIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5QdWJsaWMgZW5kcG9pbnQ8L3RleHQ+PHRleHQgeD0iNDE0IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPkFjY2VzcyByZXN0cmljdGVkPC90ZXh0PjxwYXRoIGQ9Ik01MzYsODAgaDIyIGwtNiwtNSBtNiw1IGwtNiw1IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPjxyZWN0IHg9IjU2NCIgeT0iNDAiIHdpZHRoPSIyNDAiIGhlaWdodD0iODAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6Izk0YTNiOCIvPjx0ZXh0IHg9IjY4NCIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5PcmlnaW48L3RleHQ+PHRleHQgeD0iNjg0IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPkNoZWNrcyB0aGUgcmVxdWVzdDwvdGV4dD48L3N2Zz4=)

#### Web application firewall

The distribution's WAF rules go into a Front Door firewall policy, which a security policy attaches to the endpoint. Supported AWS custom match and rate-limit rules become Front Door conditions and actions, and a geographic restriction becomes a country-match rule. An AWS `web_acl_id` only refers to an AWS web ACL; it does not become an Azure policy on its own.

Standard supports custom match rules, rate limits and country rules. Microsoft-managed rule sets and bot protection require Premium. If your web ACL relies on AWS managed rule groups, you need a different protection plan, because custom rules alone do not reproduce those groups.

#### Cache behavior

The default and ordered cache behaviors become rules matched by path. A route configuration override sets each rule's cache duration and query-string behavior, and compression is set on the route. Check which query parameters are part of the cache key, especially for personalized responses.

Front Door has one cache duration where CloudFront has minimum, default and maximum TTLs. The default TTL becomes the cache duration, and the build reports the separate minimum and maximum. Forwarded-header lists and allowed-method lists also differ. Check the effective cache key and request handling; do not assume that two requests CloudFront kept apart stay separate.

#### Domains and certificates

Each alias becomes a Front Door custom domain with a certificate that Front Door issues and renews. Front Door does not copy an ACM certificate from its ARN. Complete domain validation and wait until the certificate is ready before you change DNS. The minimum TLS version and SSL support method differ, so check them.

Supported Route 53 aliases are updated to point at Front Door's endpoint, and a reference to the distribution's `domain_name` or `id` now points at the endpoint too. `arn` and `hosted_zone_id` have no Azure equivalent: a reference in an output is removed, and a reference anywhere else causes a build error. Update DNS consumers and allowlists outside the stack yourself.

#### Limitations

Where CloudFront and Front Door Standard differ

* **Edge function code is not supported.** Front Door does not run Lambda\@Edge or CloudFront Functions code. A distribution that associates either causes a build error. Express header changes, URL rewrites and redirects as Front Door rules, and move other logic to a suitable runtime before cutover.
* **CloudFront signed URLs and cookies are not supported.** Front Door cannot check CloudFront's RSA or ECDSA signatures. A cache behavior that uses trusted signers or key groups causes a build error, and viewer authorization needs a separate application design.
* **Field-level encryption is not supported.** A distribution that uses CloudFront field-level encryption causes a build error.
* **Private origins are not supported on Standard.** A distribution whose origin is locked with OAC or OAI cannot map to Standard, because Standard has no Private Link. Map it to Front Door Premium instead.
* **TTLs behave differently: one cache duration per rule.** The default TTL becomes the cache duration. Separate minimum and maximum TTLs, including a minimum above the default, are reported and not enforced.
* **Custom error responses behave differently.** A CloudFront custom error response, such as serving `/index.html` for a 404, becomes a URL rewrite applied to the request rather than to the origin's status code. Check your single-page-app routes.
* **Price classes are not supported.** Front Door serves from Azure's own edge locations, so a CloudFront price class is dropped.
* **You must attach policy resources to a distribution.** A standalone cache, origin-request or response-headers policy, a monitoring subscription, or an origin access identity with no supported attachment causes a build error.

#### Other considerations

* **Before going live.** Confirm origin addresses, validate each custom domain and wait for its certificate, then change DNS. Restrict direct access to the public origin, and check that it rejects requests that do not come through Front Door.
* **What to monitor.** Use Azure Monitor and diagnostic settings for access logs and metrics; an AWS monitoring subscription is not a Front Door setting. After cutover, watch cache hit rate, origin health, latency and errors. Test allowed and blocked requests against the firewall policy.
* **Moving from AWS.** Nothing in the CloudFront cache is copied. Make sure the origin can take the extra load while Front Door's cache fills. Origin data moves through its own service's mapping.

## On DigitalOcean

### DigitalOcean CDN

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Origin access (OAI / OAC) | Access control | Out of scope | Most usage | origin access controls are omitted and reported during the build; a standalone origin access identity has no compiler and causes a build error |
| WAF / geo restrictions / signed URLs | Access control | Out of scope | Most usage | the WAF association and geo restrictions drop and are reported during the build; trusted signers / key groups drop under the cache-behavior issue |
| Cache behaviors | Caching | Partial | Common | the default behavior's default TTL is applied; other settings (path patterns, protocol policy, methods, forwarded values, min/max TTL) drops and are reported during the build |
| Content delivery | Data plane | Supported | Common | DigitalOcean's CDN edge serves the traffic from a CDN endpoint fronting one origin FQDN; only the first origin, default TTL, and first custom domain are mapped |
| Custom domains + TLS | Domains & TLS | Partial | Most usage | the first alias becomes the CDN custom domain; any further aliases are left behind; the viewer certificate drops with a surfaced operator step to attach a DigitalOcean-managed certificate |
| Edge logic (Lambda\@Edge / CloudFront Functions) | Edge logic | Out of scope | Most usage | associations are not translated, and drop under the blanket cache-behavior issue; a standalone cloudfront\_function resource has no compiler and causes a build error |
| Policy & monitoring facets (cache / origin-request / response-headers policies, monitoring subscription) | Facets | Out of scope | Full surface | these resources are not supported by this mapping; the build reports an error |
| Logging / price class / http version / root object | Observability | Out of scope | Full surface | dropped and are reported during the build |
| Origins | Origins | Partial | Common | the first origin's literal domain becomes the CDN origin; an expression-based origin becomes a configuration value you must confirm; additional origins and origin groups drop and are reported during the build |

#### How it works

Tensor9 maps a CloudFront distribution to one `digitalocean_cdn` endpoint when it builds your release. The endpoint takes three settings from the distribution: the first origin's domain, the default behavior's default TTL and the first custom domain. DigitalOcean operates the edge that answers your customers' requests, and Tensor9 is not in the request path.

Additional origins, ordered cache behaviors, WAF rules and edge functions are not kept, and the build reports each setting it leaves out. After the endpoint is created, you attach a DigitalOcean-managed certificate for the custom domain.

![Before: on AWS your customers reach an Amazon CloudFront distribution that fronts your origin. After: your customers reach one DigitalOcean CDN endpoint in front of your first origin, and DigitalOcean's edge answers the requests.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTk2IiB2aWV3Qm94PSIwIDAgODM2IDE5NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGN1c3RvbWVycyByZWFjaCBhbiBBbWF6b24gQ2xvdWRGcm9udCBkaXN0cmlidXRpb24gdGhhdCBmcm9udHMgeW91ciBvcmlnaW4uIEFmdGVyOiB5b3VyIGN1c3RvbWVycyByZWFjaCBvbmUgRGlnaXRhbE9jZWFuIENETiBlbmRwb2ludCBpbiBmcm9udCBvZiB5b3VyIGZpcnN0IG9yaWdpbiwgYW5kIERpZ2l0YWxPY2VhbidzIGVkZ2UgYW5zd2VycyB0aGUgcmVxdWVzdHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImRvMSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDQiIHdpZHRoPSIzODQiIGhlaWdodD0iMTMwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzAiIHk9IjYyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojOTRhM2I4Ij5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjMyIiB5PSI4MiIgd2lkdGg9IjEwNCIgaGVpZ2h0PSI2NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI4NCIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPllvdXIgY3VzdG9tZXJzPC90ZXh0Pgo8dGV4dCB4PSI4NCIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+dmlld2VyczwvdGV4dD4KPGxpbmUgeDE9IjEzNiIgeTE9IjExNSIgeDI9IjE5NiIgeTI9IjExNSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2RvMSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSIxNjYiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+cmVxdWVzdHM8L3RleHQ+CjxyZWN0IHg9IjIwMCIgeT0iNzgiIHdpZHRoPSIxODQiIGhlaWdodD0iNzQiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHN2ZyB4PSIyMTAiIHk9Ijk5IiB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAzMDQgMTgyIiBwcmVzZXJ2ZUFzcGVjdFJhdGlvPSJ4TWlkWU1pZCBtZWV0IiBzdHlsZT0iZGlzcGxheTogaW5saW5lIj48Zz4gPHBhdGggZD0iTTg2LjQsNjYuNGMwLDMuNywwLjQsNi43LDEuMSw4LjljMC44LDIuMiwxLjgsNC42LDMuMiw3LjJjMC41LDAuOCwwLjcsMS42LDAuNywyLjNjMCwxLTAuNiwyLTEuOSwzbC02LjMsNC4yIGMtMC45LDAuNi0xLjgsMC45LTIuNiwwLjljLTEsMC0yLTAuNS0zLTEuNEM3Ni4yLDkwLDc1LDg4LjQsNzQsODYuOGMtMS0xLjctMi0zLjYtMy4xLTUuOWMtNy44LDkuMi0xNy42LDEzLjgtMjkuNCwxMy44IGMtOC40LDAtMTUuMS0yLjQtMjAtNy4yYy00LjktNC44LTcuNC0xMS4yLTcuNC0xOS4yYzAtOC41LDMtMTUuNCw5LjEtMjAuNmM2LjEtNS4yLDE0LjItNy44LDI0LjUtNy44YzMuNCwwLDYuOSwwLjMsMTAuNiwwLjggYzMuNywwLjUsNy41LDEuMywxMS41LDIuMnYtNy4zYzAtNy42LTEuNi0xMi45LTQuNy0xNmMtMy4yLTMuMS04LjYtNC42LTE2LjMtNC42Yy0zLjUsMC03LjEsMC40LTEwLjgsMS4zYy0zLjcsMC45LTcuMywyLTEwLjgsMy40IGMtMS42LDAuNy0yLjgsMS4xLTMuNSwxLjNjLTAuNywwLjItMS4yLDAuMy0xLjYsMC4zYy0xLjQsMC0yLjEtMS0yLjEtMy4xdi00LjljMC0xLjYsMC4yLTIuOCwwLjctMy41YzAuNS0wLjcsMS40LTEuNCwyLjgtMi4xIGMzLjUtMS44LDcuNy0zLjMsMTIuNi00LjVjNC45LTEuMywxMC4xLTEuOSwxNS42LTEuOWMxMS45LDAsMjAuNiwyLjcsMjYuMiw4LjFjNS41LDUuNCw4LjMsMTMuNiw4LjMsMjQuNlY2Ni40eiBNNDUuOCw4MS42IGMzLjMsMCw2LjctMC42LDEwLjMtMS44YzMuNi0xLjIsNi44LTMuNCw5LjUtNi40YzEuNi0xLjksMi44LTQsMy40LTYuNGMwLjYtMi40LDEtNS4zLDEtOC43di00LjJjLTIuOS0wLjctNi0xLjMtOS4yLTEuNyBjLTMuMi0wLjQtNi4zLTAuNi05LjQtMC42Yy02LjcsMC0xMS42LDEuMy0xNC45LDRjLTMuMywyLjctNC45LDYuNS00LjksMTEuNWMwLDQuNywxLjIsOC4yLDMuNywxMC42IEMzNy43LDgwLjQsNDEuMiw4MS42LDQ1LjgsODEuNnogTTEyNi4xLDkyLjRjLTEuOCwwLTMtMC4zLTMuOC0xYy0wLjgtMC42LTEuNS0yLTIuMS0zLjlMOTYuNywxMC4yYy0wLjYtMi0wLjktMy4zLTAuOS00IGMwLTEuNiwwLjgtMi41LDIuNC0yLjVoOS44YzEuOSwwLDMuMiwwLjMsMy45LDFjMC44LDAuNiwxLjQsMiwyLDMuOWwxNi44LDY2LjJsMTUuNi02Ni4yYzAuNS0yLDEuMS0zLjMsMS45LTMuOWMwLjgtMC42LDIuMi0xLDQtMSBoOGMxLjksMCwzLjIsMC4zLDQsMWMwLjgsMC42LDEuNSwyLDEuOSwzLjlsMTUuOCw2N2wxNy4zLTY3YzAuNi0yLDEuMy0zLjMsMi0zLjljMC44LTAuNiwyLjEtMSwzLjktMWg5LjNjMS42LDAsMi41LDAuOCwyLjUsMi41IGMwLDAuNS0wLjEsMS0wLjIsMS42Yy0wLjEsMC42LTAuMywxLjQtMC43LDIuNWwtMjQuMSw3Ny4zYy0wLjYsMi0xLjMsMy4zLTIuMSwzLjljLTAuOCwwLjYtMi4xLDEtMy44LDFoLTguNmMtMS45LDAtMy4yLTAuMy00LTEgYy0wLjgtMC43LTEuNS0yLTEuOS00TDE1NiwyM2wtMTUuNCw2NC40Yy0wLjUsMi0xLjEsMy4zLTEuOSw0Yy0wLjgsMC43LTIuMiwxLTQsMUgxMjYuMXogTTI1NC42LDk1LjFjLTUuMiwwLTEwLjQtMC42LTE1LjQtMS44IGMtNS0xLjItOC45LTIuNS0xMS41LTRjLTEuNi0wLjktMi43LTEuOS0zLjEtMi44Yy0wLjQtMC45LTAuNi0xLjktMC42LTIuOHYtNS4xYzAtMi4xLDAuOC0zLjEsMi4zLTMuMWMwLjYsMCwxLjIsMC4xLDEuOCwwLjMgYzAuNiwwLjIsMS41LDAuNiwyLjUsMWMzLjQsMS41LDcuMSwyLjcsMTEsMy41YzQsMC44LDcuOSwxLjIsMTEuOSwxLjJjNi4zLDAsMTEuMi0xLjEsMTQuNi0zLjNjMy40LTIuMiw1LjItNS40LDUuMi05LjUgYzAtMi44LTAuOS01LjEtMi43LTdjLTEuOC0xLjktNS4yLTMuNi0xMC4xLTUuMkwyNDYsNTJjLTcuMy0yLjMtMTIuNy01LjctMTYtMTAuMmMtMy4zLTQuNC01LTkuMy01LTE0LjVjMC00LjIsMC45LTcuOSwyLjctMTEuMSBjMS44LTMuMiw0LjItNiw3LjItOC4yYzMtMi4zLDYuNC00LDEwLjQtNS4yYzQtMS4yLDguMi0xLjcsMTIuNi0xLjdjMi4yLDAsNC41LDAuMSw2LjcsMC40YzIuMywwLjMsNC40LDAuNyw2LjUsMS4xIGMyLDAuNSwzLjksMSw1LjcsMS42YzEuOCwwLjYsMy4yLDEuMiw0LjIsMS44YzEuNCwwLjgsMi40LDEuNiwzLDIuNWMwLjYsMC44LDAuOSwxLjksMC45LDMuM3Y0LjdjMCwyLjEtMC44LDMuMi0yLjMsMy4yIGMtMC44LDAtMi4xLTAuNC0zLjgtMS4yYy01LjctMi42LTEyLjEtMy45LTE5LjItMy45Yy01LjcsMC0xMC4yLDAuOS0xMy4zLDIuOGMtMy4xLDEuOS00LjcsNC44LTQuNyw4LjljMCwyLjgsMSw1LjIsMyw3LjEgYzIsMS45LDUuNywzLjgsMTEsNS41bDE0LjIsNC41YzcuMiwyLjMsMTIuNCw1LjUsMTUuNSw5LjZjMy4xLDQuMSw0LjYsOC44LDQuNiwxNGMwLDQuMy0wLjksOC4yLTIuNiwxMS42IGMtMS44LDMuNC00LjIsNi40LTcuMyw4LjhjLTMuMSwyLjUtNi44LDQuMy0xMS4xLDUuNkMyNjQuNCw5NC40LDI1OS43LDk1LjEsMjU0LjYsOTUuMXoiIHN0eWxlPSJmaWxsOiMyNTJGM0UiLz4gPGc+IDxwYXRoIGQ9Ik0yNzMuNSwxNDMuN2MtMzIuOSwyNC4zLTgwLjcsMzcuMi0xMjEuOCwzNy4yYy01Ny42LDAtMTA5LjUtMjEuMy0xNDguNy01Ni43Yy0zLjEtMi44LTAuMy02LjYsMy40LTQuNCBjNDIuNCwyNC42LDk0LjcsMzkuNSwxNDguOCwzOS41YzM2LjUsMCw3Ni42LTcuNiwxMTMuNS0yMy4yQzI3NC4yLDEzMy42LDI3OC45LDEzOS43LDI3My41LDE0My43eiIgc3R5bGU9ImZpbGwtcnVsZTpldmVub2RkO2NsaXAtcnVsZTpldmVub2RkO2ZpbGw6I0ZGOTkwMCIvPiA8cGF0aCBkPSJNMjg3LjIsMTI4LjFjLTQuMi01LjQtMjcuOC0yLjYtMzguNS0xLjNjLTMuMiwwLjQtMy43LTIuNC0wLjgtNC41YzE4LjgtMTMuMiw0OS43LTkuNCw1My4zLTUgYzMuNiw0LjUtMSwzNS40LTE4LjYsNTAuMmMtMi43LDIuMy01LjMsMS4xLTQuMS0xLjlDMjgyLjUsMTU1LjcsMjkxLjQsMTMzLjQsMjg3LjIsMTI4LjF6IiBzdHlsZT0iZmlsbC1ydWxlOmV2ZW5vZGQ7Y2xpcC1ydWxlOmV2ZW5vZGQ7ZmlsbDojRkY5OTAwIi8+IDwvZz4gPC9nPjwvc3ZnPjxzdmcgeD0iMjEwIiB5PSI5OSIgd2lkdGg9IjE2IiBoZWlnaHQ9IjE2IiB2aWV3Qm94PSIwIDAgMzA0IDE4MiIgcHJlc2VydmVBc3BlY3RSYXRpbz0ieE1pZFlNaWQgbWVldCIgc3R5bGU9ImRpc3BsYXk6IG5vbmUiPjxnPiA8cGF0aCBkPSJNODYuNCw2Ni40YzAsMy43LDAuNCw2LjcsMS4xLDguOWMwLjgsMi4yLDEuOCw0LjYsMy4yLDcuMmMwLjUsMC44LDAuNywxLjYsMC43LDIuM2MwLDEtMC42LDItMS45LDNsLTYuMyw0LjIgYy0wLjksMC42LTEuOCwwLjktMi42LDAuOWMtMSwwLTItMC41LTMtMS40Qzc2LjIsOTAsNzUsODguNCw3NCw4Ni44Yy0xLTEuNy0yLTMuNi0zLjEtNS45Yy03LjgsOS4yLTE3LjYsMTMuOC0yOS40LDEzLjggYy04LjQsMC0xNS4xLTIuNC0yMC03LjJjLTQuOS00LjgtNy40LTExLjItNy40LTE5LjJjMC04LjUsMy0xNS40LDkuMS0yMC42YzYuMS01LjIsMTQuMi03LjgsMjQuNS03LjhjMy40LDAsNi45LDAuMywxMC42LDAuOCBjMy43LDAuNSw3LjUsMS4zLDExLjUsMi4ydi03LjNjMC03LjYtMS42LTEyLjktNC43LTE2Yy0zLjItMy4xLTguNi00LjYtMTYuMy00LjZjLTMuNSwwLTcuMSwwLjQtMTAuOCwxLjNjLTMuNywwLjktNy4zLDItMTAuOCwzLjQgYy0xLjYsMC43LTIuOCwxLjEtMy41LDEuM2MtMC43LDAuMi0xLjIsMC4zLTEuNiwwLjNjLTEuNCwwLTIuMS0xLTIuMS0zLjF2LTQuOWMwLTEuNiwwLjItMi44LDAuNy0zLjVjMC41LTAuNywxLjQtMS40LDIuOC0yLjEgYzMuNS0xLjgsNy43LTMuMywxMi42LTQuNWM0LjktMS4zLDEwLjEtMS45LDE1LjYtMS45YzExLjksMCwyMC42LDIuNywyNi4yLDguMWM1LjUsNS40LDguMywxMy42LDguMywyNC42VjY2LjR6IE00NS44LDgxLjYgYzMuMywwLDYuNy0wLjYsMTAuMy0xLjhjMy42LTEuMiw2LjgtMy40LDkuNS02LjRjMS42LTEuOSwyLjgtNCwzLjQtNi40YzAuNi0yLjQsMS01LjMsMS04Ljd2LTQuMmMtMi45LTAuNy02LTEuMy05LjItMS43IGMtMy4yLTAuNC02LjMtMC42LTkuNC0wLjZjLTYuNywwLTExLjYsMS4zLTE0LjksNGMtMy4zLDIuNy00LjksNi41LTQuOSwxMS41YzAsNC43LDEuMiw4LjIsMy43LDEwLjYgQzM3LjcsODAuNCw0MS4yLDgxLjYsNDUuOCw4MS42eiBNMTI2LjEsOTIuNGMtMS44LDAtMy0wLjMtMy44LTFjLTAuOC0wLjYtMS41LTItMi4xLTMuOUw5Ni43LDEwLjJjLTAuNi0yLTAuOS0zLjMtMC45LTQgYzAtMS42LDAuOC0yLjUsMi40LTIuNWg5LjhjMS45LDAsMy4yLDAuMywzLjksMWMwLjgsMC42LDEuNCwyLDIsMy45bDE2LjgsNjYuMmwxNS42LTY2LjJjMC41LTIsMS4xLTMuMywxLjktMy45YzAuOC0wLjYsMi4yLTEsNC0xIGg4YzEuOSwwLDMuMiwwLjMsNCwxYzAuOCwwLjYsMS41LDIsMS45LDMuOWwxNS44LDY3bDE3LjMtNjdjMC42LTIsMS4zLTMuMywyLTMuOWMwLjgtMC42LDIuMS0xLDMuOS0xaDkuM2MxLjYsMCwyLjUsMC44LDIuNSwyLjUgYzAsMC41LTAuMSwxLTAuMiwxLjZjLTAuMSwwLjYtMC4zLDEuNC0wLjcsMi41bC0yNC4xLDc3LjNjLTAuNiwyLTEuMywzLjMtMi4xLDMuOWMtMC44LDAuNi0yLjEsMS0zLjgsMWgtOC42Yy0xLjksMC0zLjItMC4zLTQtMSBjLTAuOC0wLjctMS41LTItMS45LTRMMTU2LDIzbC0xNS40LDY0LjRjLTAuNSwyLTEuMSwzLjMtMS45LDRjLTAuOCwwLjctMi4yLDEtNCwxSDEyNi4xeiBNMjU0LjYsOTUuMWMtNS4yLDAtMTAuNC0wLjYtMTUuNC0xLjggYy01LTEuMi04LjktMi41LTExLjUtNGMtMS42LTAuOS0yLjctMS45LTMuMS0yLjhjLTAuNC0wLjktMC42LTEuOS0wLjYtMi44di01LjFjMC0yLjEsMC44LTMuMSwyLjMtMy4xYzAuNiwwLDEuMiwwLjEsMS44LDAuMyBjMC42LDAuMiwxLjUsMC42LDIuNSwxYzMuNCwxLjUsNy4xLDIuNywxMSwzLjVjNCwwLjgsNy45LDEuMiwxMS45LDEuMmM2LjMsMCwxMS4yLTEuMSwxNC42LTMuM2MzLjQtMi4yLDUuMi01LjQsNS4yLTkuNSBjMC0yLjgtMC45LTUuMS0yLjctN2MtMS44LTEuOS01LjItMy42LTEwLjEtNS4yTDI0Niw1MmMtNy4zLTIuMy0xMi43LTUuNy0xNi0xMC4yYy0zLjMtNC40LTUtOS4zLTUtMTQuNWMwLTQuMiwwLjktNy45LDIuNy0xMS4xIGMxLjgtMy4yLDQuMi02LDcuMi04LjJjMy0yLjMsNi40LTQsMTAuNC01LjJjNC0xLjIsOC4yLTEuNywxMi42LTEuN2MyLjIsMCw0LjUsMC4xLDYuNywwLjRjMi4zLDAuMyw0LjQsMC43LDYuNSwxLjEgYzIsMC41LDMuOSwxLDUuNywxLjZjMS44LDAuNiwzLjIsMS4yLDQuMiwxLjhjMS40LDAuOCwyLjQsMS42LDMsMi41YzAuNiwwLjgsMC45LDEuOSwwLjksMy4zdjQuN2MwLDIuMS0wLjgsMy4yLTIuMywzLjIgYy0wLjgsMC0yLjEtMC40LTMuOC0xLjJjLTUuNy0yLjYtMTIuMS0zLjktMTkuMi0zLjljLTUuNywwLTEwLjIsMC45LTEzLjMsMi44Yy0zLjEsMS45LTQuNyw0LjgtNC43LDguOWMwLDIuOCwxLDUuMiwzLDcuMSBjMiwxLjksNS43LDMuOCwxMSw1LjVsMTQuMiw0LjVjNy4yLDIuMywxMi40LDUuNSwxNS41LDkuNmMzLjEsNC4xLDQuNiw4LjgsNC42LDE0YzAsNC4zLTAuOSw4LjItMi42LDExLjYgYy0xLjgsMy40LTQuMiw2LjQtNy4zLDguOGMtMy4xLDIuNS02LjgsNC4zLTExLjEsNS42QzI2NC40LDk0LjQsMjU5LjcsOTUuMSwyNTQuNiw5NS4xeiIgc3R5bGU9ImZpbGw6I0ZGRkZGRiIvPiA8Zz4gPHBhdGggZD0iTTI3My41LDE0My43Yy0zMi45LDI0LjMtODAuNywzNy4yLTEyMS44LDM3LjJjLTU3LjYsMC0xMDkuNS0yMS4zLTE0OC43LTU2LjdjLTMuMS0yLjgtMC4zLTYuNiwzLjQtNC40IGM0Mi40LDI0LjYsOTQuNywzOS41LDE0OC44LDM5LjVjMzYuNSwwLDc2LjYtNy42LDExMy41LTIzLjJDMjc0LjIsMTMzLjYsMjc4LjksMTM5LjcsMjczLjUsMTQzLjd6IiBzdHlsZT0iZmlsbC1ydWxlOmV2ZW5vZGQ7Y2xpcC1ydWxlOmV2ZW5vZGQ7ZmlsbDojRkY5OTAwIi8+IDxwYXRoIGQ9Ik0yODcuMiwxMjguMWMtNC4yLTUuNC0yNy44LTIuNi0zOC41LTEuM2MtMy4yLDAuNC0zLjctMi40LTAuOC00LjVjMTguOC0xMy4yLDQ5LjctOS40LDUzLjMtNSBjMy42LDQuNS0xLDM1LjQtMTguNiw1MC4yYy0yLjcsMi4zLTUuMywxLjEtNC4xLTEuOUMyODIuNSwxNTUuNywyOTEuNCwxMzMuNCwyODcuMiwxMjguMXoiIHN0eWxlPSJmaWxsLXJ1bGU6ZXZlbm9kZDtjbGlwLXJ1bGU6ZXZlbm9kZDtmaWxsOiNGRjk5MDAiLz4gPC9nPiA8L2c+PC9zdmc+Cjx0ZXh0IHg9IjI5MiIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPkFtYXpvbiBDbG91ZEZyb250PC90ZXh0Pgo8dGV4dCB4PSIyOTIiIHk9IjEyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPmRpc3RyaWJ1dGlvbiDCtyBmcm9udHMgeW91ciBvcmlnaW48L3RleHQ+CjxsaW5lIHgxPSI0MTgiIHkxPSI0MCIgeDI9IjQxOCIgeTI9IjE2NCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6I2NiZDVlMSIvPgo8cmVjdCB4PSI0MzYiIHk9IjQ0IiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjEzMCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ1MCIgeT0iNjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPk9OIFRIRSBUQVJHRVQgQ0xPVUQ8L3RleHQ+CjxyZWN0IHg9IjQ1MiIgeT0iODIiIHdpZHRoPSIxMDQiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNTA0IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+WW91ciBjdXN0b21lcnM8L3RleHQ+Cjx0ZXh0IHg9IjUwNCIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZpbGw6IzA0Nzg1NyI+c2FtZSByZXF1ZXN0czwvdGV4dD4KPGxpbmUgeDE9IjU1NiIgeTE9IjExNSIgeDI9IjYxMiIgeTI9IjExNSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2RvMSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8dGV4dCB4PSI1ODQiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiM0ZjQ2ZTUiPnJlcXVlc3RzPC90ZXh0Pgo8cmVjdCB4PSI2MTYiIHk9Ijc0IiB3aWR0aD0iMTkyIiBoZWlnaHQ9IjgyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojNGY0NmU1Ii8+CjxzdmcgeD0iNjI2IiB5PSI5MSIgd2lkdGg9IjE2IiBoZWlnaHQ9IjE2IiB2aWV3Qm94PSIwIDAgMzIgMzIiIHByZXNlcnZlQXNwZWN0UmF0aW89InhNaWRZTWlkIG1lZXQiIGZpbGw9Im5vbmUiPjxwYXRoIGQ9Ik0xNi4wMjE5IDI1LjgwMzZWMzJDMjYuNDg3NCAzMiAzNC42MzE2IDIxLjg4ODEgMzEuMjA2NSAxMC45MDJDMjkuNjg0MiA2LjExMjE0IDI1Ljg3ODUgMi4yNzI2OCAyMS4wODM0IDAuNzkwMTEyQzEwLjEyMzEgLTIuNjMxMTkgMCA1LjU0MTkyIDAgMTUuOTk1OUg2LjIwMzI0QzYuMjAzMjQgOS40NTc0MSAxMi43MTA5IDQuMzYzNDcgMTkuNjM3MiA2Ljg3MjQzQzIyLjE4NyA3Ljc4NDc4IDI0LjI0MjEgOS44Mzc1NiAyNS4xNTU1IDEyLjM4NDVDMjcuNjY3MiAxOS4zMDMyIDIyLjYwNTcgMjUuODAzNiAxNi4wMjE5IDI1LjgwMzZaIiBzdHlsZT0iZmlsbDojNDc1NTY5Ii8+IDxwYXRoIGQ9Ik05Ljg1NTQ3IDI1Ljg0MTdIMTYuMDIwNlYxOS42ODM0SDkuODU1NDdWMjUuODQxN1oiIHN0eWxlPSJmaWxsOiM0NzU1NjkiLz4gPHBhdGggZD0iTTkuODU0NzQgMzAuNTkzNEg1LjA5NzY2VjI1Ljg0MTdMOS44NTU0NyAyNS44NDE3TDkuODU0NzQgMzAuNTkzNFoiIHN0eWxlPSJmaWxsOiM0NzU1NjkiLz4gPHBhdGggZD0iTTEuMTA5MzggMjUuODQxN0g1LjA2NzI3VjIxLjg4ODJIMS4xMDkzOFYyNS44NDE3WiIgc3R5bGU9ImZpbGw6IzQ3NTU2OSIvPjwvc3ZnPgo8dGV4dCB4PSI3MTIiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5EaWdpdGFsT2NlYW4gQ0ROPC90ZXh0Pgo8dGV4dCB4PSI3MTIiIHk9IjEyMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPk9uZSBDRE4gZW5kcG9pbnQ8L3RleHQ+Cjx0ZXh0IHg9IjcxMiIgeT0iMTM2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+RnJvbnRzIHlvdXIgZmlyc3Qgb3JpZ2luPC90ZXh0Pgo8L3N2Zz4=)

![Before: on AWS your customers reach an Amazon CloudFront distribution that fronts your origin. After: your customers reach one DigitalOcean CDN endpoint in front of your first origin, and DigitalOcean's edge answers the requests.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTk2IiB2aWV3Qm94PSIwIDAgODM2IDE5NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJCZWZvcmU6IG9uIEFXUyB5b3VyIGN1c3RvbWVycyByZWFjaCBhbiBBbWF6b24gQ2xvdWRGcm9udCBkaXN0cmlidXRpb24gdGhhdCBmcm9udHMgeW91ciBvcmlnaW4uIEFmdGVyOiB5b3VyIGN1c3RvbWVycyByZWFjaCBvbmUgRGlnaXRhbE9jZWFuIENETiBlbmRwb2ludCBpbiBmcm9udCBvZiB5b3VyIGZpcnN0IG9yaWdpbiwgYW5kIERpZ2l0YWxPY2VhbidzIGVkZ2UgYW5zd2VycyB0aGUgcmVxdWVzdHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImRvMSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8cmVjdCB4PSIxNiIgeT0iNDQiIHdpZHRoPSIzODQiIGhlaWdodD0iMTMwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzAiIHk9IjYyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNjQ3NDhiIj5PTiBBV1MgVE9EQVk8L3RleHQ+CjxyZWN0IHg9IjMyIiB5PSI4MiIgd2lkdGg9IjEwNCIgaGVpZ2h0PSI2NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI4NCIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPllvdXIgY3VzdG9tZXJzPC90ZXh0Pgo8dGV4dCB4PSI4NCIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+dmlld2VyczwvdGV4dD4KPGxpbmUgeDE9IjEzNiIgeTE9IjExNSIgeDI9IjE5NiIgeTI9IjExNSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2RvMSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSIxNjYiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+cmVxdWVzdHM8L3RleHQ+CjxyZWN0IHg9IjIwMCIgeT0iNzgiIHdpZHRoPSIxODQiIGhlaWdodD0iNzQiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHN2ZyB4PSIyMTAiIHk9Ijk5IiB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAzMDQgMTgyIiBwcmVzZXJ2ZUFzcGVjdFJhdGlvPSJ4TWlkWU1pZCBtZWV0IiBzdHlsZT0iZGlzcGxheTogbm9uZSI+PGc+IDxwYXRoIGQ9Ik04Ni40LDY2LjRjMCwzLjcsMC40LDYuNywxLjEsOC45YzAuOCwyLjIsMS44LDQuNiwzLjIsNy4yYzAuNSwwLjgsMC43LDEuNiwwLjcsMi4zYzAsMS0wLjYsMi0xLjksM2wtNi4zLDQuMiBjLTAuOSwwLjYtMS44LDAuOS0yLjYsMC45Yy0xLDAtMi0wLjUtMy0xLjRDNzYuMiw5MCw3NSw4OC40LDc0LDg2LjhjLTEtMS43LTItMy42LTMuMS01LjljLTcuOCw5LjItMTcuNiwxMy44LTI5LjQsMTMuOCBjLTguNCwwLTE1LjEtMi40LTIwLTcuMmMtNC45LTQuOC03LjQtMTEuMi03LjQtMTkuMmMwLTguNSwzLTE1LjQsOS4xLTIwLjZjNi4xLTUuMiwxNC4yLTcuOCwyNC41LTcuOGMzLjQsMCw2LjksMC4zLDEwLjYsMC44IGMzLjcsMC41LDcuNSwxLjMsMTEuNSwyLjJ2LTcuM2MwLTcuNi0xLjYtMTIuOS00LjctMTZjLTMuMi0zLjEtOC42LTQuNi0xNi4zLTQuNmMtMy41LDAtNy4xLDAuNC0xMC44LDEuM2MtMy43LDAuOS03LjMsMi0xMC44LDMuNCBjLTEuNiwwLjctMi44LDEuMS0zLjUsMS4zYy0wLjcsMC4yLTEuMiwwLjMtMS42LDAuM2MtMS40LDAtMi4xLTEtMi4xLTMuMXYtNC45YzAtMS42LDAuMi0yLjgsMC43LTMuNWMwLjUtMC43LDEuNC0xLjQsMi44LTIuMSBjMy41LTEuOCw3LjctMy4zLDEyLjYtNC41YzQuOS0xLjMsMTAuMS0xLjksMTUuNi0xLjljMTEuOSwwLDIwLjYsMi43LDI2LjIsOC4xYzUuNSw1LjQsOC4zLDEzLjYsOC4zLDI0LjZWNjYuNHogTTQ1LjgsODEuNiBjMy4zLDAsNi43LTAuNiwxMC4zLTEuOGMzLjYtMS4yLDYuOC0zLjQsOS41LTYuNGMxLjYtMS45LDIuOC00LDMuNC02LjRjMC42LTIuNCwxLTUuMywxLTguN3YtNC4yYy0yLjktMC43LTYtMS4zLTkuMi0xLjcgYy0zLjItMC40LTYuMy0wLjYtOS40LTAuNmMtNi43LDAtMTEuNiwxLjMtMTQuOSw0Yy0zLjMsMi43LTQuOSw2LjUtNC45LDExLjVjMCw0LjcsMS4yLDguMiwzLjcsMTAuNiBDMzcuNyw4MC40LDQxLjIsODEuNiw0NS44LDgxLjZ6IE0xMjYuMSw5Mi40Yy0xLjgsMC0zLTAuMy0zLjgtMWMtMC44LTAuNi0xLjUtMi0yLjEtMy45TDk2LjcsMTAuMmMtMC42LTItMC45LTMuMy0wLjktNCBjMC0xLjYsMC44LTIuNSwyLjQtMi41aDkuOGMxLjksMCwzLjIsMC4zLDMuOSwxYzAuOCwwLjYsMS40LDIsMiwzLjlsMTYuOCw2Ni4ybDE1LjYtNjYuMmMwLjUtMiwxLjEtMy4zLDEuOS0zLjljMC44LTAuNiwyLjItMSw0LTEgaDhjMS45LDAsMy4yLDAuMyw0LDFjMC44LDAuNiwxLjUsMiwxLjksMy45bDE1LjgsNjdsMTcuMy02N2MwLjYtMiwxLjMtMy4zLDItMy45YzAuOC0wLjYsMi4xLTEsMy45LTFoOS4zYzEuNiwwLDIuNSwwLjgsMi41LDIuNSBjMCwwLjUtMC4xLDEtMC4yLDEuNmMtMC4xLDAuNi0wLjMsMS40LTAuNywyLjVsLTI0LjEsNzcuM2MtMC42LDItMS4zLDMuMy0yLjEsMy45Yy0wLjgsMC42LTIuMSwxLTMuOCwxaC04LjZjLTEuOSwwLTMuMi0wLjMtNC0xIGMtMC44LTAuNy0xLjUtMi0xLjktNEwxNTYsMjNsLTE1LjQsNjQuNGMtMC41LDItMS4xLDMuMy0xLjksNGMtMC44LDAuNy0yLjIsMS00LDFIMTI2LjF6IE0yNTQuNiw5NS4xYy01LjIsMC0xMC40LTAuNi0xNS40LTEuOCBjLTUtMS4yLTguOS0yLjUtMTEuNS00Yy0xLjYtMC45LTIuNy0xLjktMy4xLTIuOGMtMC40LTAuOS0wLjYtMS45LTAuNi0yLjh2LTUuMWMwLTIuMSwwLjgtMy4xLDIuMy0zLjFjMC42LDAsMS4yLDAuMSwxLjgsMC4zIGMwLjYsMC4yLDEuNSwwLjYsMi41LDFjMy40LDEuNSw3LjEsMi43LDExLDMuNWM0LDAuOCw3LjksMS4yLDExLjksMS4yYzYuMywwLDExLjItMS4xLDE0LjYtMy4zYzMuNC0yLjIsNS4yLTUuNCw1LjItOS41IGMwLTIuOC0wLjktNS4xLTIuNy03Yy0xLjgtMS45LTUuMi0zLjYtMTAuMS01LjJMMjQ2LDUyYy03LjMtMi4zLTEyLjctNS43LTE2LTEwLjJjLTMuMy00LjQtNS05LjMtNS0xNC41YzAtNC4yLDAuOS03LjksMi43LTExLjEgYzEuOC0zLjIsNC4yLTYsNy4yLTguMmMzLTIuMyw2LjQtNCwxMC40LTUuMmM0LTEuMiw4LjItMS43LDEyLjYtMS43YzIuMiwwLDQuNSwwLjEsNi43LDAuNGMyLjMsMC4zLDQuNCwwLjcsNi41LDEuMSBjMiwwLjUsMy45LDEsNS43LDEuNmMxLjgsMC42LDMuMiwxLjIsNC4yLDEuOGMxLjQsMC44LDIuNCwxLjYsMywyLjVjMC42LDAuOCwwLjksMS45LDAuOSwzLjN2NC43YzAsMi4xLTAuOCwzLjItMi4zLDMuMiBjLTAuOCwwLTIuMS0wLjQtMy44LTEuMmMtNS43LTIuNi0xMi4xLTMuOS0xOS4yLTMuOWMtNS43LDAtMTAuMiwwLjktMTMuMywyLjhjLTMuMSwxLjktNC43LDQuOC00LjcsOC45YzAsMi44LDEsNS4yLDMsNy4xIGMyLDEuOSw1LjcsMy44LDExLDUuNWwxNC4yLDQuNWM3LjIsMi4zLDEyLjQsNS41LDE1LjUsOS42YzMuMSw0LjEsNC42LDguOCw0LjYsMTRjMCw0LjMtMC45LDguMi0yLjYsMTEuNiBjLTEuOCwzLjQtNC4yLDYuNC03LjMsOC44Yy0zLjEsMi41LTYuOCw0LjMtMTEuMSw1LjZDMjY0LjQsOTQuNCwyNTkuNyw5NS4xLDI1NC42LDk1LjF6IiBzdHlsZT0iZmlsbDojMjUyRjNFIi8+IDxnPiA8cGF0aCBkPSJNMjczLjUsMTQzLjdjLTMyLjksMjQuMy04MC43LDM3LjItMTIxLjgsMzcuMmMtNTcuNiwwLTEwOS41LTIxLjMtMTQ4LjctNTYuN2MtMy4xLTIuOC0wLjMtNi42LDMuNC00LjQgYzQyLjQsMjQuNiw5NC43LDM5LjUsMTQ4LjgsMzkuNWMzNi41LDAsNzYuNi03LjYsMTEzLjUtMjMuMkMyNzQuMiwxMzMuNiwyNzguOSwxMzkuNywyNzMuNSwxNDMuN3oiIHN0eWxlPSJmaWxsLXJ1bGU6ZXZlbm9kZDtjbGlwLXJ1bGU6ZXZlbm9kZDtmaWxsOiNGRjk5MDAiLz4gPHBhdGggZD0iTTI4Ny4yLDEyOC4xYy00LjItNS40LTI3LjgtMi42LTM4LjUtMS4zYy0zLjIsMC40LTMuNy0yLjQtMC44LTQuNWMxOC44LTEzLjIsNDkuNy05LjQsNTMuMy01IGMzLjYsNC41LTEsMzUuNC0xOC42LDUwLjJjLTIuNywyLjMtNS4zLDEuMS00LjEtMS45QzI4Mi41LDE1NS43LDI5MS40LDEzMy40LDI4Ny4yLDEyOC4xeiIgc3R5bGU9ImZpbGwtcnVsZTpldmVub2RkO2NsaXAtcnVsZTpldmVub2RkO2ZpbGw6I0ZGOTkwMCIvPiA8L2c+IDwvZz48L3N2Zz48c3ZnIHg9IjIxMCIgeT0iOTkiIHdpZHRoPSIxNiIgaGVpZ2h0PSIxNiIgdmlld0JveD0iMCAwIDMwNCAxODIiIHByZXNlcnZlQXNwZWN0UmF0aW89InhNaWRZTWlkIG1lZXQiIHN0eWxlPSJkaXNwbGF5OiBpbmxpbmUiPjxnPiA8cGF0aCBkPSJNODYuNCw2Ni40YzAsMy43LDAuNCw2LjcsMS4xLDguOWMwLjgsMi4yLDEuOCw0LjYsMy4yLDcuMmMwLjUsMC44LDAuNywxLjYsMC43LDIuM2MwLDEtMC42LDItMS45LDNsLTYuMyw0LjIgYy0wLjksMC42LTEuOCwwLjktMi42LDAuOWMtMSwwLTItMC41LTMtMS40Qzc2LjIsOTAsNzUsODguNCw3NCw4Ni44Yy0xLTEuNy0yLTMuNi0zLjEtNS45Yy03LjgsOS4yLTE3LjYsMTMuOC0yOS40LDEzLjggYy04LjQsMC0xNS4xLTIuNC0yMC03LjJjLTQuOS00LjgtNy40LTExLjItNy40LTE5LjJjMC04LjUsMy0xNS40LDkuMS0yMC42YzYuMS01LjIsMTQuMi03LjgsMjQuNS03LjhjMy40LDAsNi45LDAuMywxMC42LDAuOCBjMy43LDAuNSw3LjUsMS4zLDExLjUsMi4ydi03LjNjMC03LjYtMS42LTEyLjktNC43LTE2Yy0zLjItMy4xLTguNi00LjYtMTYuMy00LjZjLTMuNSwwLTcuMSwwLjQtMTAuOCwxLjNjLTMuNywwLjktNy4zLDItMTAuOCwzLjQgYy0xLjYsMC43LTIuOCwxLjEtMy41LDEuM2MtMC43LDAuMi0xLjIsMC4zLTEuNiwwLjNjLTEuNCwwLTIuMS0xLTIuMS0zLjF2LTQuOWMwLTEuNiwwLjItMi44LDAuNy0zLjVjMC41LTAuNywxLjQtMS40LDIuOC0yLjEgYzMuNS0xLjgsNy43LTMuMywxMi42LTQuNWM0LjktMS4zLDEwLjEtMS45LDE1LjYtMS45YzExLjksMCwyMC42LDIuNywyNi4yLDguMWM1LjUsNS40LDguMywxMy42LDguMywyNC42VjY2LjR6IE00NS44LDgxLjYgYzMuMywwLDYuNy0wLjYsMTAuMy0xLjhjMy42LTEuMiw2LjgtMy40LDkuNS02LjRjMS42LTEuOSwyLjgtNCwzLjQtNi40YzAuNi0yLjQsMS01LjMsMS04Ljd2LTQuMmMtMi45LTAuNy02LTEuMy05LjItMS43IGMtMy4yLTAuNC02LjMtMC42LTkuNC0wLjZjLTYuNywwLTExLjYsMS4zLTE0LjksNGMtMy4zLDIuNy00LjksNi41LTQuOSwxMS41YzAsNC43LDEuMiw4LjIsMy43LDEwLjYgQzM3LjcsODAuNCw0MS4yLDgxLjYsNDUuOCw4MS42eiBNMTI2LjEsOTIuNGMtMS44LDAtMy0wLjMtMy44LTFjLTAuOC0wLjYtMS41LTItMi4xLTMuOUw5Ni43LDEwLjJjLTAuNi0yLTAuOS0zLjMtMC45LTQgYzAtMS42LDAuOC0yLjUsMi40LTIuNWg5LjhjMS45LDAsMy4yLDAuMywzLjksMWMwLjgsMC42LDEuNCwyLDIsMy45bDE2LjgsNjYuMmwxNS42LTY2LjJjMC41LTIsMS4xLTMuMywxLjktMy45YzAuOC0wLjYsMi4yLTEsNC0xIGg4YzEuOSwwLDMuMiwwLjMsNCwxYzAuOCwwLjYsMS41LDIsMS45LDMuOWwxNS44LDY3bDE3LjMtNjdjMC42LTIsMS4zLTMuMywyLTMuOWMwLjgtMC42LDIuMS0xLDMuOS0xaDkuM2MxLjYsMCwyLjUsMC44LDIuNSwyLjUgYzAsMC41LTAuMSwxLTAuMiwxLjZjLTAuMSwwLjYtMC4zLDEuNC0wLjcsMi41bC0yNC4xLDc3LjNjLTAuNiwyLTEuMywzLjMtMi4xLDMuOWMtMC44LDAuNi0yLjEsMS0zLjgsMWgtOC42Yy0xLjksMC0zLjItMC4zLTQtMSBjLTAuOC0wLjctMS41LTItMS45LTRMMTU2LDIzbC0xNS40LDY0LjRjLTAuNSwyLTEuMSwzLjMtMS45LDRjLTAuOCwwLjctMi4yLDEtNCwxSDEyNi4xeiBNMjU0LjYsOTUuMWMtNS4yLDAtMTAuNC0wLjYtMTUuNC0xLjggYy01LTEuMi04LjktMi41LTExLjUtNGMtMS42LTAuOS0yLjctMS45LTMuMS0yLjhjLTAuNC0wLjktMC42LTEuOS0wLjYtMi44di01LjFjMC0yLjEsMC44LTMuMSwyLjMtMy4xYzAuNiwwLDEuMiwwLjEsMS44LDAuMyBjMC42LDAuMiwxLjUsMC42LDIuNSwxYzMuNCwxLjUsNy4xLDIuNywxMSwzLjVjNCwwLjgsNy45LDEuMiwxMS45LDEuMmM2LjMsMCwxMS4yLTEuMSwxNC42LTMuM2MzLjQtMi4yLDUuMi01LjQsNS4yLTkuNSBjMC0yLjgtMC45LTUuMS0yLjctN2MtMS44LTEuOS01LjItMy42LTEwLjEtNS4yTDI0Niw1MmMtNy4zLTIuMy0xMi43LTUuNy0xNi0xMC4yYy0zLjMtNC40LTUtOS4zLTUtMTQuNWMwLTQuMiwwLjktNy45LDIuNy0xMS4xIGMxLjgtMy4yLDQuMi02LDcuMi04LjJjMy0yLjMsNi40LTQsMTAuNC01LjJjNC0xLjIsOC4yLTEuNywxMi42LTEuN2MyLjIsMCw0LjUsMC4xLDYuNywwLjRjMi4zLDAuMyw0LjQsMC43LDYuNSwxLjEgYzIsMC41LDMuOSwxLDUuNywxLjZjMS44LDAuNiwzLjIsMS4yLDQuMiwxLjhjMS40LDAuOCwyLjQsMS42LDMsMi41YzAuNiwwLjgsMC45LDEuOSwwLjksMy4zdjQuN2MwLDIuMS0wLjgsMy4yLTIuMywzLjIgYy0wLjgsMC0yLjEtMC40LTMuOC0xLjJjLTUuNy0yLjYtMTIuMS0zLjktMTkuMi0zLjljLTUuNywwLTEwLjIsMC45LTEzLjMsMi44Yy0zLjEsMS45LTQuNyw0LjgtNC43LDguOWMwLDIuOCwxLDUuMiwzLDcuMSBjMiwxLjksNS43LDMuOCwxMSw1LjVsMTQuMiw0LjVjNy4yLDIuMywxMi40LDUuNSwxNS41LDkuNmMzLjEsNC4xLDQuNiw4LjgsNC42LDE0YzAsNC4zLTAuOSw4LjItMi42LDExLjYgYy0xLjgsMy40LTQuMiw2LjQtNy4zLDguOGMtMy4xLDIuNS02LjgsNC4zLTExLjEsNS42QzI2NC40LDk0LjQsMjU5LjcsOTUuMSwyNTQuNiw5NS4xeiIgc3R5bGU9ImZpbGw6I0ZGRkZGRiIvPiA8Zz4gPHBhdGggZD0iTTI3My41LDE0My43Yy0zMi45LDI0LjMtODAuNywzNy4yLTEyMS44LDM3LjJjLTU3LjYsMC0xMDkuNS0yMS4zLTE0OC43LTU2LjdjLTMuMS0yLjgtMC4zLTYuNiwzLjQtNC40IGM0Mi40LDI0LjYsOTQuNywzOS41LDE0OC44LDM5LjVjMzYuNSwwLDc2LjYtNy42LDExMy41LTIzLjJDMjc0LjIsMTMzLjYsMjc4LjksMTM5LjcsMjczLjUsMTQzLjd6IiBzdHlsZT0iZmlsbC1ydWxlOmV2ZW5vZGQ7Y2xpcC1ydWxlOmV2ZW5vZGQ7ZmlsbDojRkY5OTAwIi8+IDxwYXRoIGQ9Ik0yODcuMiwxMjguMWMtNC4yLTUuNC0yNy44LTIuNi0zOC41LTEuM2MtMy4yLDAuNC0zLjctMi40LTAuOC00LjVjMTguOC0xMy4yLDQ5LjctOS40LDUzLjMtNSBjMy42LDQuNS0xLDM1LjQtMTguNiw1MC4yYy0yLjcsMi4zLTUuMywxLjEtNC4xLTEuOUMyODIuNSwxNTUuNywyOTEuNCwxMzMuNCwyODcuMiwxMjguMXoiIHN0eWxlPSJmaWxsLXJ1bGU6ZXZlbm9kZDtjbGlwLXJ1bGU6ZXZlbm9kZDtmaWxsOiNGRjk5MDAiLz4gPC9nPiA8L2c+PC9zdmc+Cjx0ZXh0IHg9IjI5MiIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPkFtYXpvbiBDbG91ZEZyb250PC90ZXh0Pgo8dGV4dCB4PSIyOTIiIHk9IjEyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPmRpc3RyaWJ1dGlvbiDCtyBmcm9udHMgeW91ciBvcmlnaW48L3RleHQ+CjxsaW5lIHgxPSI0MTgiIHkxPSI0MCIgeDI9IjQxOCIgeTI9IjE2NCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6IzQ3NTU2OSIvPgo8cmVjdCB4PSI0MzYiIHk9IjQ0IiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjEzMCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ1MCIgeT0iNjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPk9OIFRIRSBUQVJHRVQgQ0xPVUQ8L3RleHQ+CjxyZWN0IHg9IjQ1MiIgeT0iODIiIHdpZHRoPSIxMDQiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNTA0IiB5PSIxMTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+WW91ciBjdXN0b21lcnM8L3RleHQ+Cjx0ZXh0IHg9IjUwNCIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZpbGw6IzZlZTdiNyI+c2FtZSByZXF1ZXN0czwvdGV4dD4KPGxpbmUgeDE9IjU1NiIgeTE9IjExNSIgeDI9IjYxMiIgeTI9IjExNSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2RvMSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8dGV4dCB4PSI1ODQiIHk9IjEwNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweDtmaWxsOiNhNWI0ZmMiPnJlcXVlc3RzPC90ZXh0Pgo8cmVjdCB4PSI2MTYiIHk9Ijc0IiB3aWR0aD0iMTkyIiBoZWlnaHQ9IjgyIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojYTViNGZjIi8+CjxzdmcgeD0iNjI2IiB5PSI5MSIgd2lkdGg9IjE2IiBoZWlnaHQ9IjE2IiB2aWV3Qm94PSIwIDAgMzIgMzIiIHByZXNlcnZlQXNwZWN0UmF0aW89InhNaWRZTWlkIG1lZXQiIGZpbGw9Im5vbmUiPjxwYXRoIGQ9Ik0xNi4wMjE5IDI1LjgwMzZWMzJDMjYuNDg3NCAzMiAzNC42MzE2IDIxLjg4ODEgMzEuMjA2NSAxMC45MDJDMjkuNjg0MiA2LjExMjE0IDI1Ljg3ODUgMi4yNzI2OCAyMS4wODM0IDAuNzkwMTEyQzEwLjEyMzEgLTIuNjMxMTkgMCA1LjU0MTkyIDAgMTUuOTk1OUg2LjIwMzI0QzYuMjAzMjQgOS40NTc0MSAxMi43MTA5IDQuMzYzNDcgMTkuNjM3MiA2Ljg3MjQzQzIyLjE4NyA3Ljc4NDc4IDI0LjI0MjEgOS44Mzc1NiAyNS4xNTU1IDEyLjM4NDVDMjcuNjY3MiAxOS4zMDMyIDIyLjYwNTcgMjUuODAzNiAxNi4wMjE5IDI1LjgwMzZaIiBzdHlsZT0iZmlsbDojY2JkNWUxIi8+IDxwYXRoIGQ9Ik05Ljg1NTQ3IDI1Ljg0MTdIMTYuMDIwNlYxOS42ODM0SDkuODU1NDdWMjUuODQxN1oiIHN0eWxlPSJmaWxsOiNjYmQ1ZTEiLz4gPHBhdGggZD0iTTkuODU0NzQgMzAuNTkzNEg1LjA5NzY2VjI1Ljg0MTdMOS44NTU0NyAyNS44NDE3TDkuODU0NzQgMzAuNTkzNFoiIHN0eWxlPSJmaWxsOiNjYmQ1ZTEiLz4gPHBhdGggZD0iTTEuMTA5MzggMjUuODQxN0g1LjA2NzI3VjIxLjg4ODJIMS4xMDkzOFYyNS44NDE3WiIgc3R5bGU9ImZpbGw6I2NiZDVlMSIvPjwvc3ZnPgo8dGV4dCB4PSI3MTIiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5EaWdpdGFsT2NlYW4gQ0ROPC90ZXh0Pgo8dGV4dCB4PSI3MTIiIHk9IjEyMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPk9uZSBDRE4gZW5kcG9pbnQ8L3RleHQ+Cjx0ZXh0IHg9IjcxMiIgeT0iMTM2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+RnJvbnRzIHlvdXIgZmlyc3Qgb3JpZ2luPC90ZXh0Pgo8L3N2Zz4=)

Your customers reach the same content through one DigitalOcean CDN endpoint, which DigitalOcean's edge serves.

#### Supported configuration

The first origin's domain becomes `origin`, the default behavior's default TTL becomes `ttl`, and the first alias becomes `custom_domain`. Further aliases are not used. Limitations lists the settings that are left out and reported during the build.

![Your CloudFront distribution has multiple origins, ordered cache behaviors, alternate domain names, WAF and geographic restrictions, and edge functions. Only three settings transfer to the digitalocean\_cdn endpoint: the first origin's domain becomes origin, the default TTL becomes ttl, and the first alias becomes custom\_domain. The build reports everything else.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMzAwIiB2aWV3Qm94PSIwIDAgODM2IDMwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIENsb3VkRnJvbnQgZGlzdHJpYnV0aW9uIGhhcyBtdWx0aXBsZSBvcmlnaW5zLCBvcmRlcmVkIGNhY2hlIGJlaGF2aW9ycywgYWx0ZXJuYXRlIGRvbWFpbiBuYW1lcywgV0FGIGFuZCBnZW9ncmFwaGljIHJlc3RyaWN0aW9ucywgYW5kIGVkZ2UgZnVuY3Rpb25zLiBPbmx5IHRocmVlIHNldHRpbmdzIHRyYW5zZmVyIHRvIHRoZSBkaWdpdGFsb2NlYW5fY2RuIGVuZHBvaW50OiB0aGUgZmlyc3Qgb3JpZ2luJ3MgZG9tYWluIGJlY29tZXMgb3JpZ2luLCB0aGUgZGVmYXVsdCBUVEwgYmVjb21lcyB0dGwsIGFuZCB0aGUgZmlyc3QgYWxpYXMgYmVjb21lcyBjdXN0b21fZG9tYWluLiBUaGUgYnVpbGQgcmVwb3J0cyBldmVyeXRoaW5nIGVsc2UuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImRvMiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNGY0NmU1Ii8+PC9tYXJrZXI+PG1hcmtlciBpZD0iZG8yYSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojZjU5ZTBiIi8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNiIgeT0iMzQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiM2NDc0OGIiPllPVVIgQ0xPVURGUk9OVCBESVNUUklCVVRJT048L3RleHQ+CjxyZWN0IHg9IjI2IiB5PSI0OCIgd2lkdGg9IjIxMCIgaGVpZ2h0PSIzMiIgcng9IjgiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQwIiB5PSI2OCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+bXVsdGlwbGUgb3JpZ2lucyArIGdyb3VwczwvdGV4dD4KPHJlY3QgeD0iMjYiIHk9Ijg2IiB3aWR0aD0iMjEwIiBoZWlnaHQ9IjMyIiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDAiIHk9IjEwNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+b3JkZXJlZCBjYWNoZSBiZWhhdmlvcnM8L3RleHQ+CjxyZWN0IHg9IjI2IiB5PSIxMjQiIHdpZHRoPSIyMTAiIGhlaWdodD0iMzIiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0MCIgeT0iMTQ0IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1Ij5hbHRlcm5hdGUgZG9tYWluIG5hbWVzPC90ZXh0Pgo8cmVjdCB4PSIyNiIgeT0iMTYyIiB3aWR0aD0iMjEwIiBoZWlnaHQ9IjMyIiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDAiIHk9IjE4MiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+V0FGICsgZ2VvIHJlc3RyaWN0aW9uczwvdGV4dD4KPHJlY3QgeD0iMjYiIHk9IjIwMCIgd2lkdGg9IjIxMCIgaGVpZ2h0PSIzMiIgcng9IjgiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQwIiB5PSIyMjAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPmVkZ2UgZnVuY3Rpb25zICsgcHJpY2UgY2xhc3M8L3RleHQ+Cjxwb2x5Z29uIHBvaW50cz0iMjQ2LDQ0IDUyMCwxMzYgNTIwLDE3MiAyNDYsMjM2IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA0IiBzdHlsZT0iZmlsbDojZWVmMmZmO3N0cm9rZTojNGY0NmU1Ii8+CjxsaW5lIHgxPSIyMzYiIHkxPSI2NCIgeDI9IjUxNCIgeTI9IjE1MCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6I2M3ZDJmZSIvPgo8bGluZSB4MT0iMjM2IiB5MT0iMTAyIiB4Mj0iNTE0IiB5Mj0iMTUyIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9InN0cm9rZTojYzdkMmZlIi8+CjxsaW5lIHgxPSIyMzYiIHkxPSIxNDAiIHgyPSI1MTQiIHkyPSIxNTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0ic3Ryb2tlOiNjN2QyZmUiLz4KPGxpbmUgeDE9IjIzNiIgeTE9IjE3OCIgeDI9IjUxNCIgeTI9IjE1NiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6I2M3ZDJmZSIvPgo8bGluZSB4MT0iMjM2IiB5MT0iMjE2IiB4Mj0iNTE0IiB5Mj0iMTU4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9InN0cm9rZTojYzdkMmZlIi8+Cjx0ZXh0IHg9IjM2OCIgeT0iMTIwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4O2ZpbGw6IzRmNDZlNSI+dGhyZWUgc2V0dGluZ3MgdHJhbnNmZXI8L3RleHQ+CjxsaW5lIHgxPSI1MjAiIHkxPSIxNTQiIHgyPSI1NjAiIHkyPSIxNTQiIHN0cm9rZS13aWR0aD0iMi40IiBtYXJrZXItZW5kPSJ1cmwoI2RvMikiIHN0eWxlPSJzdHJva2U6IzRmNDZlNSIvPgo8cmVjdCB4PSI1NjQiIHk9Ijk2IiB3aWR0aD0iMjQ4IiBoZWlnaHQ9IjEyMiIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuOSIgc3R5bGU9ImZpbGw6I2VlZjJmZjtzdHJva2U6IzRmNDZlNSIvPgo8dGV4dCB4PSI1ODAiIHk9IjEyMCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzRmNDZlNSI+T05FIENETiBFTkRQT0lOVDwvdGV4dD4KPHN2ZyB4PSI1ODAiIHk9IjEyOCIgd2lkdGg9IjE4IiBoZWlnaHQ9IjE4IiB2aWV3Qm94PSIwIDAgMzIgMzIiIHByZXNlcnZlQXNwZWN0UmF0aW89InhNaWRZTWlkIG1lZXQiIGZpbGw9Im5vbmUiPjxwYXRoIGQ9Ik0xNi4wMjE5IDI1LjgwMzZWMzJDMjYuNDg3NCAzMiAzNC42MzE2IDIxLjg4ODEgMzEuMjA2NSAxMC45MDJDMjkuNjg0MiA2LjExMjE0IDI1Ljg3ODUgMi4yNzI2OCAyMS4wODM0IDAuNzkwMTEyQzEwLjEyMzEgLTIuNjMxMTkgMCA1LjU0MTkyIDAgMTUuOTk1OUg2LjIwMzI0QzYuMjAzMjQgOS40NTc0MSAxMi43MTA5IDQuMzYzNDcgMTkuNjM3MiA2Ljg3MjQzQzIyLjE4NyA3Ljc4NDc4IDI0LjI0MjEgOS44Mzc1NiAyNS4xNTU1IDEyLjM4NDVDMjcuNjY3MiAxOS4zMDMyIDIyLjYwNTcgMjUuODAzNiAxNi4wMjE5IDI1LjgwMzZaIiBzdHlsZT0iZmlsbDojNDc1NTY5Ii8+IDxwYXRoIGQ9Ik05Ljg1NTQ3IDI1Ljg0MTdIMTYuMDIwNlYxOS42ODM0SDkuODU1NDdWMjUuODQxN1oiIHN0eWxlPSJmaWxsOiM0NzU1NjkiLz4gPHBhdGggZD0iTTkuODU0NzQgMzAuNTkzNEg1LjA5NzY2VjI1Ljg0MTdMOS44NTU0NyAyNS44NDE3TDkuODU0NzQgMzAuNTkzNFoiIHN0eWxlPSJmaWxsOiM0NzU1NjkiLz4gPHBhdGggZD0iTTEuMTA5MzggMjUuODQxN0g1LjA2NzI3VjIxLjg4ODJIMS4xMDkzOFYyNS44NDE3WiIgc3R5bGU9ImZpbGw6IzQ3NTU2OSIvPjwvc3ZnPgo8dGV4dCB4PSI2MDQiIHk9IjE0MiIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMi41cHgiPmRpZ2l0YWxvY2Vhbl9jZG48L3RleHQ+Cjx0ZXh0IHg9IjU4MCIgeT0iMTY4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojMzM0MTU1Ij5vcmlnaW4gPSB5b3VyIGZpcnN0IG9yaWdpbjwvdGV4dD4KPHRleHQgeD0iNTgwIiB5PSIxODgiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPnR0bCA9IGRlZmF1bHQgVFRMPC90ZXh0Pgo8dGV4dCB4PSI1ODAiIHk9IjIwOCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+Y3VzdG9tX2RvbWFpbiA9IGZpcnN0IGFsaWFzPC90ZXh0Pgo8bGluZSB4MT0iMzY2IiB5MT0iMjA2IiB4Mj0iMzY2IiB5Mj0iMjUyIiBzdHJva2Utd2lkdGg9IjEuNiIgc3Ryb2tlLWRhc2hhcnJheT0iNCAzIiBtYXJrZXItZW5kPSJ1cmwoI2RvMmEpIiBzdHlsZT0ic3Ryb2tlOiNmNTllMGIiLz4KPHRleHQgeD0iMjg2IiB5PSIyNzQiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiNiNDUzMDkiPlRoZSBidWlsZCByZXBvcnRzIGV2ZXJ5IG90aGVyIHNldHRpbmc7IHNlZSBMaW1pdGF0aW9uczwvdGV4dD4KPC9zdmc+)

![Your CloudFront distribution has multiple origins, ordered cache behaviors, alternate domain names, WAF and geographic restrictions, and edge functions. Only three settings transfer to the digitalocean\_cdn endpoint: the first origin's domain becomes origin, the default TTL becomes ttl, and the first alias becomes custom\_domain. The build reports everything else.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMzAwIiB2aWV3Qm94PSIwIDAgODM2IDMwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIENsb3VkRnJvbnQgZGlzdHJpYnV0aW9uIGhhcyBtdWx0aXBsZSBvcmlnaW5zLCBvcmRlcmVkIGNhY2hlIGJlaGF2aW9ycywgYWx0ZXJuYXRlIGRvbWFpbiBuYW1lcywgV0FGIGFuZCBnZW9ncmFwaGljIHJlc3RyaWN0aW9ucywgYW5kIGVkZ2UgZnVuY3Rpb25zLiBPbmx5IHRocmVlIHNldHRpbmdzIHRyYW5zZmVyIHRvIHRoZSBkaWdpdGFsb2NlYW5fY2RuIGVuZHBvaW50OiB0aGUgZmlyc3Qgb3JpZ2luJ3MgZG9tYWluIGJlY29tZXMgb3JpZ2luLCB0aGUgZGVmYXVsdCBUVEwgYmVjb21lcyB0dGwsIGFuZCB0aGUgZmlyc3QgYWxpYXMgYmVjb21lcyBjdXN0b21fZG9tYWluLiBUaGUgYnVpbGQgcmVwb3J0cyBldmVyeXRoaW5nIGVsc2UuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImRvMiIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojYTViNGZjIi8+PC9tYXJrZXI+PG1hcmtlciBpZD0iZG8yYSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojZmJiZjI0Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNiIgeT0iMzQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM5NGEzYjgiPllPVVIgQ0xPVURGUk9OVCBESVNUUklCVVRJT048L3RleHQ+CjxyZWN0IHg9IjI2IiB5PSI0OCIgd2lkdGg9IjIxMCIgaGVpZ2h0PSIzMiIgcng9IjgiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQwIiB5PSI2OCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+bXVsdGlwbGUgb3JpZ2lucyArIGdyb3VwczwvdGV4dD4KPHJlY3QgeD0iMjYiIHk9Ijg2IiB3aWR0aD0iMjEwIiBoZWlnaHQ9IjMyIiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDAiIHk9IjEwNiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+b3JkZXJlZCBjYWNoZSBiZWhhdmlvcnM8L3RleHQ+CjxyZWN0IHg9IjI2IiB5PSIxMjQiIHdpZHRoPSIyMTAiIGhlaWdodD0iMzIiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuMiIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0MCIgeT0iMTQ0IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxIj5hbHRlcm5hdGUgZG9tYWluIG5hbWVzPC90ZXh0Pgo8cmVjdCB4PSIyNiIgeT0iMTYyIiB3aWR0aD0iMjEwIiBoZWlnaHQ9IjMyIiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjIiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDAiIHk9IjE4MiIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+V0FGICsgZ2VvIHJlc3RyaWN0aW9uczwvdGV4dD4KPHJlY3QgeD0iMjYiIHk9IjIwMCIgd2lkdGg9IjIxMCIgaGVpZ2h0PSIzMiIgcng9IjgiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQwIiB5PSIyMjAiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPmVkZ2UgZnVuY3Rpb25zICsgcHJpY2UgY2xhc3M8L3RleHQ+Cjxwb2x5Z29uIHBvaW50cz0iMjQ2LDQ0IDUyMCwxMzYgNTIwLDE3MiAyNDYsMjM2IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA0IiBzdHlsZT0iZmlsbDojMWUxYjRiO3N0cm9rZTojYTViNGZjIi8+CjxsaW5lIHgxPSIyMzYiIHkxPSI2NCIgeDI9IjUxNCIgeTI9IjE1MCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6IzM3MzBhMyIvPgo8bGluZSB4MT0iMjM2IiB5MT0iMTAyIiB4Mj0iNTE0IiB5Mj0iMTUyIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9InN0cm9rZTojMzczMGEzIi8+CjxsaW5lIHgxPSIyMzYiIHkxPSIxNDAiIHgyPSI1MTQiIHkyPSIxNTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0ic3Ryb2tlOiMzNzMwYTMiLz4KPGxpbmUgeDE9IjIzNiIgeTE9IjE3OCIgeDI9IjUxNCIgeTI9IjE1NiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6IzM3MzBhMyIvPgo8bGluZSB4MT0iMjM2IiB5MT0iMjE2IiB4Mj0iNTE0IiB5Mj0iMTU4IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9InN0cm9rZTojMzczMGEzIi8+Cjx0ZXh0IHg9IjM2OCIgeT0iMTIwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2E1YjRmYyI+dGhyZWUgc2V0dGluZ3MgdHJhbnNmZXI8L3RleHQ+CjxsaW5lIHgxPSI1MjAiIHkxPSIxNTQiIHgyPSI1NjAiIHkyPSIxNTQiIHN0cm9rZS13aWR0aD0iMi40IiBtYXJrZXItZW5kPSJ1cmwoI2RvMikiIHN0eWxlPSJzdHJva2U6I2E1YjRmYyIvPgo8cmVjdCB4PSI1NjQiIHk9Ijk2IiB3aWR0aD0iMjQ4IiBoZWlnaHQ9IjEyMiIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuOSIgc3R5bGU9ImZpbGw6IzFlMWI0YjtzdHJva2U6I2E1YjRmYyIvPgo8dGV4dCB4PSI1ODAiIHk9IjEyMCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6I2E1YjRmYyI+T05FIENETiBFTkRQT0lOVDwvdGV4dD4KPHN2ZyB4PSI1ODAiIHk9IjEyOCIgd2lkdGg9IjE4IiBoZWlnaHQ9IjE4IiB2aWV3Qm94PSIwIDAgMzIgMzIiIHByZXNlcnZlQXNwZWN0UmF0aW89InhNaWRZTWlkIG1lZXQiIGZpbGw9Im5vbmUiPjxwYXRoIGQ9Ik0xNi4wMjE5IDI1LjgwMzZWMzJDMjYuNDg3NCAzMiAzNC42MzE2IDIxLjg4ODEgMzEuMjA2NSAxMC45MDJDMjkuNjg0MiA2LjExMjE0IDI1Ljg3ODUgMi4yNzI2OCAyMS4wODM0IDAuNzkwMTEyQzEwLjEyMzEgLTIuNjMxMTkgMCA1LjU0MTkyIDAgMTUuOTk1OUg2LjIwMzI0QzYuMjAzMjQgOS40NTc0MSAxMi43MTA5IDQuMzYzNDcgMTkuNjM3MiA2Ljg3MjQzQzIyLjE4NyA3Ljc4NDc4IDI0LjI0MjEgOS44Mzc1NiAyNS4xNTU1IDEyLjM4NDVDMjcuNjY3MiAxOS4zMDMyIDIyLjYwNTcgMjUuODAzNiAxNi4wMjE5IDI1LjgwMzZaIiBzdHlsZT0iZmlsbDojY2JkNWUxIi8+IDxwYXRoIGQ9Ik05Ljg1NTQ3IDI1Ljg0MTdIMTYuMDIwNlYxOS42ODM0SDkuODU1NDdWMjUuODQxN1oiIHN0eWxlPSJmaWxsOiNjYmQ1ZTEiLz4gPHBhdGggZD0iTTkuODU0NzQgMzAuNTkzNEg1LjA5NzY2VjI1Ljg0MTdMOS44NTU0NyAyNS44NDE3TDkuODU0NzQgMzAuNTkzNFoiIHN0eWxlPSJmaWxsOiNjYmQ1ZTEiLz4gPHBhdGggZD0iTTEuMTA5MzggMjUuODQxN0g1LjA2NzI3VjIxLjg4ODJIMS4xMDkzOFYyNS44NDE3WiIgc3R5bGU9ImZpbGw6I2NiZDVlMSIvPjwvc3ZnPgo8dGV4dCB4PSI2MDQiIHk9IjE0MiIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMi41cHgiPmRpZ2l0YWxvY2Vhbl9jZG48L3RleHQ+Cjx0ZXh0IHg9IjU4MCIgeT0iMTY4IiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojY2JkNWUxIj5vcmlnaW4gPSB5b3VyIGZpcnN0IG9yaWdpbjwvdGV4dD4KPHRleHQgeD0iNTgwIiB5PSIxODgiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPnR0bCA9IGRlZmF1bHQgVFRMPC90ZXh0Pgo8dGV4dCB4PSI1ODAiIHk9IjIwOCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+Y3VzdG9tX2RvbWFpbiA9IGZpcnN0IGFsaWFzPC90ZXh0Pgo8bGluZSB4MT0iMzY2IiB5MT0iMjA2IiB4Mj0iMzY2IiB5Mj0iMjUyIiBzdHJva2Utd2lkdGg9IjEuNiIgc3Ryb2tlLWRhc2hhcnJheT0iNCAzIiBtYXJrZXItZW5kPSJ1cmwoI2RvMmEpIiBzdHlsZT0ic3Ryb2tlOiNmYmJmMjQiLz4KPHRleHQgeD0iMjg2IiB5PSIyNzQiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmaWxsOiNmYmJmMjQiPlRoZSBidWlsZCByZXBvcnRzIGV2ZXJ5IG90aGVyIHNldHRpbmc7IHNlZSBMaW1pdGF0aW9uczwvdGV4dD4KPC9zdmc+)

Three settings transfer to the CDN endpoint; the build reports the rest.

#### How traffic flows

After the release is built, your customers' requests reach DigitalOcean's CDN edge, which fetches from your first origin: the bucket or app behind the distribution. A Route 53 alias that pointed at the distribution now points at the `digitalocean_cdn` endpoint, so the name your customers use does not change.

Resources that read the CDN's endpoint or id keep working. The distribution's `domain_name`, `arn` and `hosted_zone_id` have no DigitalOcean equivalent. A reference to one inside an output removes that output, and the build reports it. A reference anywhere else causes a build error, rather than pointing at the wrong host.

![Your customers reach DigitalOcean's CDN edge, which fetches from your first origin. A Route 53 alias that pointed at the distribution now points at the digitalocean\_cdn endpoint, and references to the endpoint and its id keep working.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGN1c3RvbWVycyByZWFjaCBEaWdpdGFsT2NlYW4ncyBDRE4gZWRnZSwgd2hpY2ggZmV0Y2hlcyBmcm9tIHlvdXIgZmlyc3Qgb3JpZ2luLiBBIFJvdXRlIDUzIGFsaWFzIHRoYXQgcG9pbnRlZCBhdCB0aGUgZGlzdHJpYnV0aW9uIG5vdyBwb2ludHMgYXQgdGhlIGRpZ2l0YWxvY2Vhbl9jZG4gZW5kcG9pbnQsIGFuZCByZWZlcmVuY2VzIHRvIHRoZSBlbmRwb2ludCBhbmQgaXRzIGlkIGtlZXAgd29ya2luZy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZG8zIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48bWFya2VyIGlkPSJkbzNiIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM0ZjQ2ZTUiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIzNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+VEhFIFJFUVVFU1QgUEFUSDwvdGV4dD4KPHJlY3QgeD0iMjYiIHk9IjQ2IiB3aWR0aD0iMTIwIiBoZWlnaHQ9IjcwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9Ijg2IiB5PSI3OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5Zb3VyIGN1c3RvbWVyczwvdGV4dD4KPHRleHQgeD0iODYiIHk9Ijk0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+dmlld2VyczwvdGV4dD4KPGxpbmUgeDE9IjE0NiIgeTE9IjgxIiB4Mj0iMjAwIiB5Mj0iODEiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNkbzMpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iMTczIiB5PSI3MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+cmVxdWVzdHM8L3RleHQ+CjxyZWN0IHg9IjIwNCIgeT0iNDAiIHdpZHRoPSIyMDYiIGhlaWdodD0iODIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiM0ZjQ2ZTUiLz4KPHN2ZyB4PSIyMTQiIHk9IjU3IiB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAzMiAzMiIgcHJlc2VydmVBc3BlY3RSYXRpbz0ieE1pZFlNaWQgbWVldCIgZmlsbD0ibm9uZSI+PHBhdGggZD0iTTE2LjAyMTkgMjUuODAzNlYzMkMyNi40ODc0IDMyIDM0LjYzMTYgMjEuODg4MSAzMS4yMDY1IDEwLjkwMkMyOS42ODQyIDYuMTEyMTQgMjUuODc4NSAyLjI3MjY4IDIxLjA4MzQgMC43OTAxMTJDMTAuMTIzMSAtMi42MzExOSAwIDUuNTQxOTIgMCAxNS45OTU5SDYuMjAzMjRDNi4yMDMyNCA5LjQ1NzQxIDEyLjcxMDkgNC4zNjM0NyAxOS42MzcyIDYuODcyNDNDMjIuMTg3IDcuNzg0NzggMjQuMjQyMSA5LjgzNzU2IDI1LjE1NTUgMTIuMzg0NUMyNy42NjcyIDE5LjMwMzIgMjIuNjA1NyAyNS44MDM2IDE2LjAyMTkgMjUuODAzNloiIHN0eWxlPSJmaWxsOiM0NzU1NjkiLz4gPHBhdGggZD0iTTkuODU1NDcgMjUuODQxN0gxNi4wMjA2VjE5LjY4MzRIOS44NTU0N1YyNS44NDE3WiIgc3R5bGU9ImZpbGw6IzQ3NTU2OSIvPiA8cGF0aCBkPSJNOS44NTQ3NCAzMC41OTM0SDUuMDk3NjZWMjUuODQxN0w5Ljg1NTQ3IDI1Ljg0MTdMOS44NTQ3NCAzMC41OTM0WiIgc3R5bGU9ImZpbGw6IzQ3NTU2OSIvPiA8cGF0aCBkPSJNMS4xMDkzOCAyNS44NDE3SDUuMDY3MjdWMjEuODg4MkgxLjEwOTM4VjI1Ljg0MTdaIiBzdHlsZT0iZmlsbDojNDc1NTY5Ii8+PC9zdmc+Cjx0ZXh0IHg9IjMwNyIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTIuNXB4Ij5EaWdpdGFsT2NlYW4gQ0ROPC90ZXh0Pgo8dGV4dCB4PSIzMDciIHk9Ijg2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+RWRnZSBhbnN3ZXJzIHJlcXVlc3RzPC90ZXh0Pgo8dGV4dCB4PSIzMDciIHk9IjEwMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmaWxsOiM0ZjQ2ZTUiPkZyb20geW91ciBmaXJzdCBvcmlnaW48L3RleHQ+CjxsaW5lIHgxPSI0MTAiIHkxPSI4MSIgeDI9IjQ2NCIgeTI9IjgxIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZG8zKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjQzNyIgeT0iNzIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPm9yaWdpbiBmZXRjaDwvdGV4dD4KPHJlY3QgeD0iNDY4IiB5PSI0NiIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI3MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI1NDMiIHk9Ijc4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPllvdXIgZmlyc3Qgb3JpZ2luPC90ZXh0Pgo8dGV4dCB4PSI1NDMiIHk9Ijk0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+YnVja2V0IG9yIGFwcDwvdGV4dD4KPGxpbmUgeDE9IjE2IiB5MT0iMTQwIiB4Mj0iODIwIiB5Mj0iMTQwIiBzdHJva2Utd2lkdGg9IjEuMiIgc3Ryb2tlLWRhc2hhcnJheT0iNCA0IiBzdHlsZT0ic3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMjYiIHk9IjE2NCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzRmNDZlNSI+V0hBVCBZT1VSIENPTkZJR1VSQVRJT04gS0VFUFM8L3RleHQ+CjxyZWN0IHg9IjI2IiB5PSIxNzYiIHdpZHRoPSIxNjgiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTEwIiB5PSIyMDAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij5Sb3V0ZSA1MyBhbGlhczwvdGV4dD4KPHRleHQgeD0iMTEwIiB5PSIyMTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmb250LXNpemU6MTBweCI+YXBwLmV4YW1wbGUuY29tIMK3IHVuY2hhbmdlZDwvdGV4dD4KPGxpbmUgeDE9IjE5NCIgeTE9IjIwNSIgeDI9IjI0NiIgeTI9IjIwNSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2RvM2IpIiBzdHlsZT0ic3Ryb2tlOiM0ZjQ2ZTUiLz4KPHRleHQgeD0iMjIwIiB5PSIxOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OHB4O2ZpbGw6IzRmNDZlNSI+cG9pbnRzIHRvPC90ZXh0Pgo8cmVjdCB4PSIyNTAiIHk9IjE3NiIgd2lkdGg9IjIzNiIgaGVpZ2h0PSI1OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9ImZpbGw6I2VlZjJmZjtzdHJva2U6IzRmNDZlNSIvPgo8c3ZnIHg9IjI2NCIgeT0iMTg4IiB3aWR0aD0iMTgiIGhlaWdodD0iMTgiIHZpZXdCb3g9IjAgMCAzMiAzMiIgcHJlc2VydmVBc3BlY3RSYXRpbz0ieE1pZFlNaWQgbWVldCIgZmlsbD0ibm9uZSI+PHBhdGggZD0iTTE2LjAyMTkgMjUuODAzNlYzMkMyNi40ODc0IDMyIDM0LjYzMTYgMjEuODg4MSAzMS4yMDY1IDEwLjkwMkMyOS42ODQyIDYuMTEyMTQgMjUuODc4NSAyLjI3MjY4IDIxLjA4MzQgMC43OTAxMTJDMTAuMTIzMSAtMi42MzExOSAwIDUuNTQxOTIgMCAxNS45OTU5SDYuMjAzMjRDNi4yMDMyNCA5LjQ1NzQxIDEyLjcxMDkgNC4zNjM0NyAxOS42MzcyIDYuODcyNDNDMjIuMTg3IDcuNzg0NzggMjQuMjQyMSA5LjgzNzU2IDI1LjE1NTUgMTIuMzg0NUMyNy42NjcyIDE5LjMwMzIgMjIuNjA1NyAyNS44MDM2IDE2LjAyMTkgMjUuODAzNloiIHN0eWxlPSJmaWxsOiM0NzU1NjkiLz4gPHBhdGggZD0iTTkuODU1NDcgMjUuODQxN0gxNi4wMjA2VjE5LjY4MzRIOS44NTU0N1YyNS44NDE3WiIgc3R5bGU9ImZpbGw6IzQ3NTU2OSIvPiA8cGF0aCBkPSJNOS44NTQ3NCAzMC41OTM0SDUuMDk3NjZWMjUuODQxN0w5Ljg1NTQ3IDI1Ljg0MTdMOS44NTQ3NCAzMC41OTM0WiIgc3R5bGU9ImZpbGw6IzQ3NTU2OSIvPiA8cGF0aCBkPSJNMS4xMDkzOCAyNS44NDE3SDUuMDY3MjdWMjEuODg4MkgxLjEwOTM4VjI1Ljg0MTdaIiBzdHlsZT0iZmlsbDojNDc1NTY5Ii8+PC9zdmc+Cjx0ZXh0IHg9IjM3NiIgeT0iMjAwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweCI+ZGlnaXRhbG9jZWFuX2NkbiBlbmRwb2ludDwvdGV4dD4KPHRleHQgeD0iMzc2IiB5PSIyMTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5EaWdpdGFsT2NlYW4ncyBlZGdlIGFuc3dlcnM8L3RleHQ+CjxsaW5lIHgxPSI0ODYiIHkxPSIyMDUiIHgyPSI1MzgiIHkyPSIyMDUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNkbzMpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iNTEyIiB5PSIxOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OHB4Ij5lbmRwb2ludCArIGlkPC90ZXh0Pgo8cmVjdCB4PSI1NDIiIHk9IjE3NiIgd2lkdGg9IjI3OCIgaGVpZ2h0PSI1OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI2ODEiIHk9IjIwMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMnB4Ij5Zb3VyIG90aGVyIHJlc291cmNlczwvdGV4dD4KPHRleHQgeD0iNjgxIiB5PSIyMTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5SZWFkIHRoZSBlbmRwb2ludCBhbmQgaWQ8L3RleHQ+Cjwvc3ZnPg==)

![Your customers reach DigitalOcean's CDN edge, which fetches from your first origin. A Route 53 alias that pointed at the distribution now points at the digitalocean\_cdn endpoint, and references to the endpoint and its id keep working.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjUwIiB2aWV3Qm94PSIwIDAgODM2IDI1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGN1c3RvbWVycyByZWFjaCBEaWdpdGFsT2NlYW4ncyBDRE4gZWRnZSwgd2hpY2ggZmV0Y2hlcyBmcm9tIHlvdXIgZmlyc3Qgb3JpZ2luLiBBIFJvdXRlIDUzIGFsaWFzIHRoYXQgcG9pbnRlZCBhdCB0aGUgZGlzdHJpYnV0aW9uIG5vdyBwb2ludHMgYXQgdGhlIGRpZ2l0YWxvY2Vhbl9jZG4gZW5kcG9pbnQsIGFuZCByZWZlcmVuY2VzIHRvIHRoZSBlbmRwb2ludCBhbmQgaXRzIGlkIGtlZXAgd29ya2luZy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZG8zIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48bWFya2VyIGlkPSJkbzNiIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiNhNWI0ZmMiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIzNCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+VEhFIFJFUVVFU1QgUEFUSDwvdGV4dD4KPHJlY3QgeD0iMjYiIHk9IjQ2IiB3aWR0aD0iMTIwIiBoZWlnaHQ9IjcwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9Ijg2IiB5PSI3OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5Zb3VyIGN1c3RvbWVyczwvdGV4dD4KPHRleHQgeD0iODYiIHk9Ijk0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+dmlld2VyczwvdGV4dD4KPGxpbmUgeDE9IjE0NiIgeTE9IjgxIiB4Mj0iMjAwIiB5Mj0iODEiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNkbzMpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iMTczIiB5PSI3MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+cmVxdWVzdHM8L3RleHQ+CjxyZWN0IHg9IjIwNCIgeT0iNDAiIHdpZHRoPSIyMDYiIGhlaWdodD0iODIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiNhNWI0ZmMiLz4KPHN2ZyB4PSIyMTQiIHk9IjU3IiB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAzMiAzMiIgcHJlc2VydmVBc3BlY3RSYXRpbz0ieE1pZFlNaWQgbWVldCIgZmlsbD0ibm9uZSI+PHBhdGggZD0iTTE2LjAyMTkgMjUuODAzNlYzMkMyNi40ODc0IDMyIDM0LjYzMTYgMjEuODg4MSAzMS4yMDY1IDEwLjkwMkMyOS42ODQyIDYuMTEyMTQgMjUuODc4NSAyLjI3MjY4IDIxLjA4MzQgMC43OTAxMTJDMTAuMTIzMSAtMi42MzExOSAwIDUuNTQxOTIgMCAxNS45OTU5SDYuMjAzMjRDNi4yMDMyNCA5LjQ1NzQxIDEyLjcxMDkgNC4zNjM0NyAxOS42MzcyIDYuODcyNDNDMjIuMTg3IDcuNzg0NzggMjQuMjQyMSA5LjgzNzU2IDI1LjE1NTUgMTIuMzg0NUMyNy42NjcyIDE5LjMwMzIgMjIuNjA1NyAyNS44MDM2IDE2LjAyMTkgMjUuODAzNloiIHN0eWxlPSJmaWxsOiNjYmQ1ZTEiLz4gPHBhdGggZD0iTTkuODU1NDcgMjUuODQxN0gxNi4wMjA2VjE5LjY4MzRIOS44NTU0N1YyNS44NDE3WiIgc3R5bGU9ImZpbGw6I2NiZDVlMSIvPiA8cGF0aCBkPSJNOS44NTQ3NCAzMC41OTM0SDUuMDk3NjZWMjUuODQxN0w5Ljg1NTQ3IDI1Ljg0MTdMOS44NTQ3NCAzMC41OTM0WiIgc3R5bGU9ImZpbGw6I2NiZDVlMSIvPiA8cGF0aCBkPSJNMS4xMDkzOCAyNS44NDE3SDUuMDY3MjdWMjEuODg4MkgxLjEwOTM4VjI1Ljg0MTdaIiBzdHlsZT0iZmlsbDojY2JkNWUxIi8+PC9zdmc+Cjx0ZXh0IHg9IjMwNyIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTIuNXB4Ij5EaWdpdGFsT2NlYW4gQ0ROPC90ZXh0Pgo8dGV4dCB4PSIzMDciIHk9Ijg2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+RWRnZSBhbnN3ZXJzIHJlcXVlc3RzPC90ZXh0Pgo8dGV4dCB4PSIzMDciIHk9IjEwMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmaWxsOiNhNWI0ZmMiPkZyb20geW91ciBmaXJzdCBvcmlnaW48L3RleHQ+CjxsaW5lIHgxPSI0MTAiIHkxPSI4MSIgeDI9IjQ2NCIgeTI9IjgxIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZG8zKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjQzNyIgeT0iNzIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPm9yaWdpbiBmZXRjaDwvdGV4dD4KPHJlY3QgeD0iNDY4IiB5PSI0NiIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI3MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI1NDMiIHk9Ijc4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPllvdXIgZmlyc3Qgb3JpZ2luPC90ZXh0Pgo8dGV4dCB4PSI1NDMiIHk9Ijk0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+YnVja2V0IG9yIGFwcDwvdGV4dD4KPGxpbmUgeDE9IjE2IiB5MT0iMTQwIiB4Mj0iODIwIiB5Mj0iMTQwIiBzdHJva2Utd2lkdGg9IjEuMiIgc3Ryb2tlLWRhc2hhcnJheT0iNCA0IiBzdHlsZT0ic3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMjYiIHk9IjE2NCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6I2E1YjRmYyI+V0hBVCBZT1VSIENPTkZJR1VSQVRJT04gS0VFUFM8L3RleHQ+CjxyZWN0IHg9IjI2IiB5PSIxNzYiIHdpZHRoPSIxNjgiIGhlaWdodD0iNTgiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTEwIiB5PSIyMDAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij5Sb3V0ZSA1MyBhbGlhczwvdGV4dD4KPHRleHQgeD0iMTEwIiB5PSIyMTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmb250LXNpemU6MTBweCI+YXBwLmV4YW1wbGUuY29tIMK3IHVuY2hhbmdlZDwvdGV4dD4KPGxpbmUgeDE9IjE5NCIgeTE9IjIwNSIgeDI9IjI0NiIgeTI9IjIwNSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2RvM2IpIiBzdHlsZT0ic3Ryb2tlOiNhNWI0ZmMiLz4KPHRleHQgeD0iMjIwIiB5PSIxOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OHB4O2ZpbGw6I2E1YjRmYyI+cG9pbnRzIHRvPC90ZXh0Pgo8cmVjdCB4PSIyNTAiIHk9IjE3NiIgd2lkdGg9IjIzNiIgaGVpZ2h0PSI1OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9ImZpbGw6IzFlMWI0YjtzdHJva2U6I2E1YjRmYyIvPgo8c3ZnIHg9IjI2NCIgeT0iMTg4IiB3aWR0aD0iMTgiIGhlaWdodD0iMTgiIHZpZXdCb3g9IjAgMCAzMiAzMiIgcHJlc2VydmVBc3BlY3RSYXRpbz0ieE1pZFlNaWQgbWVldCIgZmlsbD0ibm9uZSI+PHBhdGggZD0iTTE2LjAyMTkgMjUuODAzNlYzMkMyNi40ODc0IDMyIDM0LjYzMTYgMjEuODg4MSAzMS4yMDY1IDEwLjkwMkMyOS42ODQyIDYuMTEyMTQgMjUuODc4NSAyLjI3MjY4IDIxLjA4MzQgMC43OTAxMTJDMTAuMTIzMSAtMi42MzExOSAwIDUuNTQxOTIgMCAxNS45OTU5SDYuMjAzMjRDNi4yMDMyNCA5LjQ1NzQxIDEyLjcxMDkgNC4zNjM0NyAxOS42MzcyIDYuODcyNDNDMjIuMTg3IDcuNzg0NzggMjQuMjQyMSA5LjgzNzU2IDI1LjE1NTUgMTIuMzg0NUMyNy42NjcyIDE5LjMwMzIgMjIuNjA1NyAyNS44MDM2IDE2LjAyMTkgMjUuODAzNloiIHN0eWxlPSJmaWxsOiNjYmQ1ZTEiLz4gPHBhdGggZD0iTTkuODU1NDcgMjUuODQxN0gxNi4wMjA2VjE5LjY4MzRIOS44NTU0N1YyNS44NDE3WiIgc3R5bGU9ImZpbGw6I2NiZDVlMSIvPiA8cGF0aCBkPSJNOS44NTQ3NCAzMC41OTM0SDUuMDk3NjZWMjUuODQxN0w5Ljg1NTQ3IDI1Ljg0MTdMOS44NTQ3NCAzMC41OTM0WiIgc3R5bGU9ImZpbGw6I2NiZDVlMSIvPiA8cGF0aCBkPSJNMS4xMDkzOCAyNS44NDE3SDUuMDY3MjdWMjEuODg4MkgxLjEwOTM4VjI1Ljg0MTdaIiBzdHlsZT0iZmlsbDojY2JkNWUxIi8+PC9zdmc+Cjx0ZXh0IHg9IjM3NiIgeT0iMjAwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweCI+ZGlnaXRhbG9jZWFuX2NkbiBlbmRwb2ludDwvdGV4dD4KPHRleHQgeD0iMzc2IiB5PSIyMTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5EaWdpdGFsT2NlYW4ncyBlZGdlIGFuc3dlcnM8L3RleHQ+CjxsaW5lIHgxPSI0ODYiIHkxPSIyMDUiIHgyPSI1MzgiIHkyPSIyMDUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNkbzMpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iNTEyIiB5PSIxOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OHB4Ij5lbmRwb2ludCArIGlkPC90ZXh0Pgo8cmVjdCB4PSI1NDIiIHk9IjE3NiIgd2lkdGg9IjI3OCIgaGVpZ2h0PSI1OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI2ODEiIHk9IjIwMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMnB4Ij5Zb3VyIG90aGVyIHJlc291cmNlczwvdGV4dD4KPHRleHQgeD0iNjgxIiB5PSIyMTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5SZWFkIHRoZSBlbmRwb2ludCBhbmQgaWQ8L3RleHQ+Cjwvc3ZnPg==)

DigitalOcean's edge serves from your first origin, and your Route 53 alias now points at the CDN endpoint.

#### Limitations

Where CloudFront and DigitalOcean CDN differ

* **Only the first origin is used.** The first origin's domain becomes the CDN origin. Additional origins and origin-group failover are left out and reported during the build. For a custom origin, the port, protocol and SSL settings are not kept, so check that the CDN reaches it.
* **Path-based cache behaviors are not supported.** The CDN endpoint has one behavior, so ordered behaviors, their path patterns and their order are left out and reported during the build.
* **TTLs behave differently: one TTL per endpoint.** Only the default behavior's default TTL becomes the endpoint's `ttl`. Per-behavior TTLs and the separate minimum and maximum TTLs are left out and reported during the build.
* **Allowed and cached methods are not supported.** The CDN endpoint has no setting for the allowed-method and cached-method lists; they are left out and reported during the build.
* **The viewer protocol policy is not supported.** The DigitalOcean CDN endpoint serves over HTTPS by default. CloudFront's redirect-to-HTTPS or HTTPS-only setting has no counterpart, so it is left out and reported during the build.
* **WAF and geographic restrictions are not supported.** The CDN endpoint has nowhere to attach an AWS WAF web ACL or a geographic restriction; both are left out and reported during the build.
* **Origin access and signed URLs are not supported.** Origin access control is removed and reported, and trusted-signer signed URLs are left out. A standalone origin access identity causes a build error. Your origin must be publicly reachable.
* **Edge functions are not supported.** DigitalOcean's CDN cannot run Lambda\@Edge or CloudFront Functions code, so associations are left out. A standalone CloudFront function causes a build error.
* **Price class, logging and other edge settings are not supported.** DigitalOcean serves from its own edge locations, so there is no price class. Access logging, the HTTP version, IPv6 and the default root object are left out and reported during the build.
* **You must attach a DigitalOcean certificate.** The ACM viewer certificate has no equivalent. The endpoint uses a DigitalOcean-managed certificate for its custom domain, which you attach.

#### Other considerations

* **Before going live.** If the first origin's domain comes from an expression the build cannot resolve, set the configuration value the build reports to the DigitalOcean Spaces or load balancer address the CDN should front. After the CDN is created, attach the DigitalOcean-managed certificate for its custom domain; the build reports this step.
* **DNS cutover.** A Route 53 alias that pointed at the distribution now points at the `digitalocean_cdn` endpoint. The name your customers use does not change, but you own the cutover of that record.
* **One distribution, one endpoint.** Each CDN endpoint stands for one distribution. If a distribution cannot map cleanly, for example a standalone edge function or origin access identity with no distribution, or CloudFront resources spread across several modules, the build stops with an error and asks you to restructure.
* **Moving from AWS.** Nothing in the CloudFront cache is copied. The DigitalOcean endpoint starts empty and fills from the origin as traffic arrives.

## On Google Cloud

### Cloud CDN

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| Origin access (OAI / OAC) | Access control | Partial | Most usage | configure private bucket IAM or the HTTP origin's access controls separately. Attaching a backend to the load balancer does not prevent direct access. An origin access identity without a supported translation causes a build error |
| Signed URLs | Access control | Out of scope | Most usage | A behavior with trusted signers or trusted key groups stops the build. Cloud CDN uses HMAC signed URLs and cookies instead; you set up a new signer and issue new URLs yourself. |
| WAF & geo restrictions | Access control | Out of scope | Most usage | Automatic WAF/geo translation is outside this mapping. Configure Cloud Armor separately; backend buckets support a narrower edge security policy than backend services. |
| Cache behaviors | Cache | Partial | Most usage | Only the default cache behavior is supported; it becomes the backend's cdn\_policy (cache TTLs and the query-string setting), with TTL differences reported. A distribution with any ordered\_cache\_behavior (path-based routing) stops the build. |
| Content delivery | Content delivery | Supported | Common | served on Google Cloud CDN: enable\_cdn = true plus a cdn\_policy on the external load balancer's backend inside your Google Cloud project; the load balancer fronts it with a URL map, HTTPS proxy, and forwarding rule. A distribution created several times with count or for\_each stops the build; a conditional count of 0 or 1 is kept. |
| DNS cutover | Content delivery | Supported | Common | Supported Route 53 aliases point to the load balancer's address. References to the distribution's domain\_name and id are redirected to the global address and forwarding rule. References to arn or hosted\_zone\_id are removed from outputs with a reported issue and stop the build anywhere else. |
| Custom domains + TLS | Domains & TLS | Partial | Most usage | Custom domains use certificates managed by the backend CDN. Complete domain validation before cutover; an ACM ARN supplies no certificate material. Minimum TLS-version and SSL support-method differences are reported. |
| Edge logic (Lambda\@Edge / CloudFront Functions) | Edge logic | Out of scope | Most usage | Cloud CDN does not run Lambda\@Edge or CloudFront Functions code. An association, or field-level encryption, stops the build; standalone functions also cause a build error. |
| Policy & monitoring facets (cache / origin-request / response-headers policies, monitoring subscription) | Facets | Out of scope | Full surface | these resources are not supported by this mapping; the build reports an error |
| Origins | Origins | Partial | Common | Only a distribution with one origin is supported. An HTTP origin becomes a backend service and a bucket origin becomes a backend bucket. A distribution with more than one origin or an origin group stops the build. Confirm unresolved origin addresses. |

#### How it works

Tensor9 maps your CloudFront distribution to a Google external Application Load Balancer with Cloud CDN turned on for its backend. A forwarding rule provides the public address, an HTTPS proxy terminates TLS, and a URL map picks the backend. Tensor9 creates these resources in your Google Cloud project; Google operates the cache that answers requests.

Your custom domain name keeps working once its DNS record points at the new frontend and its certificate is ready. The CloudFront-generated hostname and the objects already in the CloudFront cache do not move to Google, so expect cache misses during cutover.

![A request to your custom domain reaches the Google load balancer, where Cloud CDN answers from cache or forwards the request to the origin.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBIHJlcXVlc3QgdG8geW91ciBjdXN0b20gZG9tYWluIHJlYWNoZXMgdGhlIEdvb2dsZSBsb2FkIGJhbGFuY2VyLCB3aGVyZSBDbG91ZCBDRE4gYW5zd2VycyBmcm9tIGNhY2hlIG9yIGZvcndhcmRzIHRoZSByZXF1ZXN0IHRvIHRoZSBvcmlnaW4uIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+PHJlY3QgeD0iMjQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiM2NDc0OGIiLz48dGV4dCB4PSIxNDQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+WW91ciBjdXN0b21lcnM8L3RleHQ+PHRleHQgeD0iMTQ0IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPlJlcXVlc3QgYSBjdXN0b20gZG9tYWluPC90ZXh0PjxwYXRoIGQ9Ik0yNjYsODAgaDIyIGwtNiwtNSBtNiw1IGwtNiw1IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPjxyZWN0IHg9IjI5NCIgeT0iNDAiIHdpZHRoPSIyNDAiIGhlaWdodD0iODAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6IzY0NzQ4YiIvPjx0ZXh0IHg9IjQxNCIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5Hb29nbGUgbG9hZCBiYWxhbmNlcjwvdGV4dD48dGV4dCB4PSI0MTQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+VVJMIG1hcCBhbmQgQ2xvdWQgQ0ROPC90ZXh0PjxwYXRoIGQ9Ik01MzYsODAgaDIyIGwtNiwtNSBtNiw1IGwtNiw1IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPjxyZWN0IHg9IjU2NCIgeT0iNDAiIHdpZHRoPSIyNDAiIGhlaWdodD0iODAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6IzY0NzQ4YiIvPjx0ZXh0IHg9IjY4NCIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5PcmlnaW48L3RleHQ+PHRleHQgeD0iNjg0IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPkJ1Y2tldCBvciBIVFRQIGJhY2tlbmQ8L3RleHQ+PC9zdmc+)

![A request to your custom domain reaches the Google load balancer, where Cloud CDN answers from cache or forwards the request to the origin.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBIHJlcXVlc3QgdG8geW91ciBjdXN0b20gZG9tYWluIHJlYWNoZXMgdGhlIEdvb2dsZSBsb2FkIGJhbGFuY2VyLCB3aGVyZSBDbG91ZCBDRE4gYW5zd2VycyBmcm9tIGNhY2hlIG9yIGZvcndhcmRzIHRoZSByZXF1ZXN0IHRvIHRoZSBvcmlnaW4uIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+PHJlY3QgeD0iMjQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM5NGEzYjgiLz48dGV4dCB4PSIxNDQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+WW91ciBjdXN0b21lcnM8L3RleHQ+PHRleHQgeD0iMTQ0IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPlJlcXVlc3QgYSBjdXN0b20gZG9tYWluPC90ZXh0PjxwYXRoIGQ9Ik0yNjYsODAgaDIyIGwtNiwtNSBtNiw1IGwtNiw1IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPjxyZWN0IHg9IjI5NCIgeT0iNDAiIHdpZHRoPSIyNDAiIGhlaWdodD0iODAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6Izk0YTNiOCIvPjx0ZXh0IHg9IjQxNCIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5Hb29nbGUgbG9hZCBiYWxhbmNlcjwvdGV4dD48dGV4dCB4PSI0MTQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+VVJMIG1hcCBhbmQgQ2xvdWQgQ0ROPC90ZXh0PjxwYXRoIGQ9Ik01MzYsODAgaDIyIGwtNiwtNSBtNiw1IGwtNiw1IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjIiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPjxyZWN0IHg9IjU2NCIgeT0iNDAiIHdpZHRoPSIyNDAiIGhlaWdodD0iODAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6Izk0YTNiOCIvPjx0ZXh0IHg9IjY4NCIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5PcmlnaW48L3RleHQ+PHRleHQgeD0iNjg0IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPkJ1Y2tldCBvciBIVFRQIGJhY2tlbmQ8L3RleHQ+PC9zdmc+)

#### Origins and caching

A bucket origin becomes a backend bucket with Cloud CDN turned on; a custom HTTP origin becomes a backend service. If the build cannot work out an origin's address, you must confirm it. Only the first origin is mapped: additional origins and CloudFront origin-group failover need separate configuration, and the build reports them.

Supported path behaviors become URL map path matchers. Each backend has a `cdn_policy` that sets the cache mode, the default, maximum and client TTLs, negative caching, and whether the host, path and query string are part of the cache key. Behaviors that share a backend share its cache policy, so check whether those paths need different policies.

The cache mode that follows origin headers respects the origin's `Cache-Control` instructions. For example, a policy might set default and client TTLs of 3600 seconds, a maximum of 86400 seconds, and cache a 404 response for 120 seconds; these are illustrations, not deployment defaults. Per-behavior forwarded-header and allowed-method lists are not fully kept. Review the reported differences before you cache authenticated or user-specific responses.

#### Origin access

The load balancer's backend says where requests go. Being in the same project does not make an origin reachable or private. You configure the network path, firewall rules, DNS and backend access for the origin type you use. A custom origin can sit outside the project and may need extra connectivity.

CloudFront origin access control (OAC) authenticates requests to supported origins; it is not a private network connection. On Google, private bucket access uses the bucket IAM grant for the load balancer. An HTTP origin needs its own controls to reject direct or unauthorized requests. Attaching a backend to a load balancer does not make the load balancer the only way to reach it.

Tensor9 creates the resources with the deployment's Google identity. Limit that identity's permissions separately from the access rules for viewer and origin requests.

#### Signed URLs and cookies

CloudFront signs URLs and cookies with an RSA or ECDSA key pair. Cloud CDN uses a shared HMAC signing key instead. You must update the application that issues signed URLs to use the Cloud CDN format and key. URLs already signed for CloudFront do not validate on Cloud CDN.

Checking viewers and protecting the origin are separate jobs. Configure private bucket access where it applies. For an HTTP origin, follow Google's requirements for validating signed requests, and decide whether to reject unsigned ones. Adding a signing key does not make every path private. Google documents [content access control](https://docs.cloud.google.com/cdn/docs/authenticate-content) and [signed URLs](https://docs.cloud.google.com/cdn/docs/using-signed-urls).

![Your application signs a URL with the Cloud CDN key, and Cloud CDN checks the signature. Access to the origin needs its own controls.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGFwcGxpY2F0aW9uIHNpZ25zIGEgVVJMIHdpdGggdGhlIENsb3VkIENETiBrZXksIGFuZCBDbG91ZCBDRE4gY2hlY2tzIHRoZSBzaWduYXR1cmUuIEFjY2VzcyB0byB0aGUgb3JpZ2luIG5lZWRzIGl0cyBvd24gY29udHJvbHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+PHJlY3QgeD0iMjQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiM2NDc0OGIiLz48dGV4dCB4PSIxNDQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+WW91ciBVUkwgc2lnbmVyPC90ZXh0Pjx0ZXh0IHg9IjE0NCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5Vc2VzIHRoZSBITUFDIGtleTwvdGV4dD48cGF0aCBkPSJNMjY2LDgwIGgyMiBsLTYsLTUgbTYsNSBsLTYsNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz48cmVjdCB4PSIyOTQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiM2NDc0OGIiLz48dGV4dCB4PSI0MTQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+Q2xvdWQgQ0ROPC90ZXh0Pjx0ZXh0IHg9IjQxNCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5DaGVja3MgdGhlIHNpZ25hdHVyZTwvdGV4dD48cGF0aCBkPSJNNTM2LDgwIGgyMiBsLTYsLTUgbTYsNSBsLTYsNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz48cmVjdCB4PSI1NjQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiM2NDc0OGIiLz48dGV4dCB4PSI2ODQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+UHJvdGVjdGVkIG9yaWdpbjwvdGV4dD48dGV4dCB4PSI2ODQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+SGFzIGl0cyBvd24gY29udHJvbHM8L3RleHQ+PC9zdmc+)

![Your application signs a URL with the Cloud CDN key, and Cloud CDN checks the signature. Access to the origin needs its own controls.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGFwcGxpY2F0aW9uIHNpZ25zIGEgVVJMIHdpdGggdGhlIENsb3VkIENETiBrZXksIGFuZCBDbG91ZCBDRE4gY2hlY2tzIHRoZSBzaWduYXR1cmUuIEFjY2VzcyB0byB0aGUgb3JpZ2luIG5lZWRzIGl0cyBvd24gY29udHJvbHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+PHJlY3QgeD0iMjQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM5NGEzYjgiLz48dGV4dCB4PSIxNDQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+WW91ciBVUkwgc2lnbmVyPC90ZXh0Pjx0ZXh0IHg9IjE0NCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5Vc2VzIHRoZSBITUFDIGtleTwvdGV4dD48cGF0aCBkPSJNMjY2LDgwIGgyMiBsLTYsLTUgbTYsNSBsLTYsNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz48cmVjdCB4PSIyOTQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM5NGEzYjgiLz48dGV4dCB4PSI0MTQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+Q2xvdWQgQ0ROPC90ZXh0Pjx0ZXh0IHg9IjQxNCIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5DaGVja3MgdGhlIHNpZ25hdHVyZTwvdGV4dD48cGF0aCBkPSJNNTM2LDgwIGgyMiBsLTYsLTUgbTYsNSBsLTYsNSIgZmlsbD0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIyIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz48cmVjdCB4PSI1NjQiIHk9IjQwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjgwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM5NGEzYjgiLz48dGV4dCB4PSI2ODQiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+UHJvdGVjdGVkIG9yaWdpbjwvdGV4dD48dGV4dCB4PSI2ODQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+SGFzIGl0cyBvd24gY29udHJvbHM8L3RleHQ+PC9zdmc+)

#### Web application firewall

The AWS web ACL and geographic restrictions are not translated. If you need those controls, configure Google Cloud Armor yourself.

A backend security policy on a backend service supports managed WAF rules, custom rules and rate limiting. A backend bucket supports only the narrower edge security policy, which lacks those managed-rule and rate-limiting features. Choose the policy type for your backend and test both allowed and blocked requests.

#### Custom domains and TLS

Each supported alias gets a Google-managed certificate on the HTTPS proxy. Validate domain ownership and wait until the certificate is ready before you change DNS. An ACM reference supplies no certificate, and the CloudFront minimum TLS version and SSL support method are not copied one for one, so check the TLS policy on the HTTPS proxy.

Supported Route 53 aliases are updated to the Google frontend address, and a reference to the distribution's `domain_name` or `id` now points at the frontend too. `arn` and `hosted_zone_id` have no Google Cloud equivalent: a reference in an output is removed, and a reference anywhere else causes a build error. Review consumers outside this stack.

#### Limitations

Where CloudFront and Cloud CDN differ

* **Edge function code is not supported.** Cloud CDN does not run Lambda\@Edge or CloudFront Functions code. A distribution that associates either causes a build error. Move the code to a suitable runtime and reconnect it to the request flow.
* **CloudFront signed URLs are not supported.** A cache behavior that names CloudFront trusted signers or key groups causes a build error. Set up Cloud CDN signing with its own HMAC key and issue new URLs.
* **Field-level encryption is not supported.** CloudFront field-level encryption encrypts selected request fields at the edge. Cloud CDN has no equivalent, and a distribution that uses it causes a build error.
* **WAF and geographic restrictions are not translated.** The AWS web ACL and country restrictions are not kept. Configure Cloud Armor for the backend type you use.
* **Only the first origin is mapped.** Additional origins and origin-group failover are reported and left out. Configure them separately on Google Cloud.
* **Cache behaviors behave differently.** Behaviors that share a backend share one cache policy. Per-behavior forwarded-header and allowed-method lists are not fully kept, and the build reports each difference.
* **Price classes are not supported.** Cloud CDN serves from Google's own edge locations, so a CloudFront price class is dropped.
* **You must attach policy resources to a distribution.** A standalone cache, origin-request or response-headers policy, a monitoring subscription, or an origin access identity with no supported attachment cannot be translated and causes a build error.

#### Other considerations

* **Before going live.** Confirm origin addresses, set up origin access and Cloud Armor, validate each custom domain and wait for its certificate, then change DNS. Review the reported per-behavior differences together with the distribution.
* **What to monitor.** Configure Cloud Logging and Cloud Monitoring for Cloud CDN; AWS access-log and additional-metrics settings are not copied. After cutover, watch cache hits, origin requests and errors.
* **Moving from AWS.** Nothing in the CloudFront cache is copied. Make sure the origin can take the extra load while the cache fills.

## Install and run

The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin:

```sh theme={null}
tensor9 adapt svc list \
  -origin aws::1.0.0::cloudfront::distribution
```

The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request.

Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction.

## Existing data and credentials

Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target.

## Configure, tune and debug

Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction.

For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.