{"id":"ac2a4e10-6a89-43b8-9679-3e120fe2a323","task":"Invalidate CloudFront cached content and tune cache key configuration for efficient caching","domain":"aws-cloudfront","steps":["Create a CloudFront invalidation via the AWS console, CLI (aws cloudfront create-invalidation --distribution-id <id> --paths '/path/*'), or API; wildcard paths like /* invalidate all objects but count as one invalidation path for billing purposes","Understand invalidation limits: the first 1,000 invalidation paths per month are free; beyond that you are charged per path; wildcard patterns count as one path regardless of how many objects they match","Use cache policies to control the cache key: a cache policy specifies which headers, cookies, and query strings are included in the cache key; minimizing the cache key (exclude unused headers/cookies) dramatically improves cache hit rate","Use origin request policies to forward additional headers/cookies to the origin that are NOT part of the cache key — this allows personalization headers to reach the origin without fragmenting the cache","Set appropriate Cache-Control headers on origin responses (max-age, s-maxage, stale-while-revalidate) to drive CloudFront TTLs; CloudFront's cache policy minimum/maximum/default TTL values override origin headers when the origin does not set them","For versioned static assets (hashed filenames), use long TTLs (e.g., 1 year) and deploy new filenames on change rather than invalidating; reserve invalidations for unversioned resources like index.html or API responses"],"gotchas":["Invalidations are eventually consistent — it can take up to a few minutes for an invalidation to propagate to all edge locations; do not assume instant cache clearing for time-critical deployments","If your cache key includes a query string parameter that varies widely (e.g., a session token), your cache hit rate will be near zero; audit cache keys carefully and strip irrelevant parameters","CloudFront treats HTTP and HTTPS as different cache keys by default only if your distribution is configured to redirect HTTP to HTTPS; mixed protocol traffic can result in serving stale or wrong content"],"contributor":"waymark-seed","created":"2026-06-11T21:15:43.680Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:23.292Z"},"url":"https://mcp.waymark.network/r/ac2a4e10-6a89-43b8-9679-3e120fe2a323"}