ability to set origin shield for less dynamic sites

[selul]

I was wondering what do you think about adding compatibility with OriginShield for the API Gateway origin in CloudFront.

It might make sense for sites where content is updated less frequently, i.e with a high expiration time, and with highly geo-distributed traffic.

[carlalexander]

I'd never heard of this actually! There are so many options to everything on AWS lol 😅

I'm not sure the service is for static content. It seems to be more for reducing load to the origin (Lambda for us). But since Lambda scales so well, it's not as critical. What seems interesting is the Better network performance and Better cache hits.

One thing you can already do for more static content is use the default_expiry configuration option and set it super high. This is what I'm doing with this site. I set it to 31536000 which is a year.

If you need to clear the cache, you can use the environment:invalidate-cache command. The whole thing has room for improvement, but it's not bad for static content right now.

One thing similar to OriginShield that I want to look into is the stale-while-revalidate cache header. It should offer very similar benefits as OriginShield without the cost.

[selul]

One thing you can already do for more static content is use the default_expiry configuration option and set it super high.

Yep, agree, I think OriginShield is more useful when you have a lot of geo-distributed traffic combined with the default_expiry.

One thing similar to OriginShield that I want to look into is the stale-while-revalidate cache header. It should offer very similar benefits as OriginShield without the cost.

From what I know this is not supported by CloudFront, not sure if lately things changed.

[carlalexander]

From what I know this is not supported by CloudFront, not sure if lately things changed.

Yeah, I didn't check. I saw an article that said they did, but I haven't looked in the AWS docs.

[carlalexander]

It doesn't seem like they do atm 😞

[selul]

Does Ymir overwrite configuration in CloudFront distribution on deployment?
I was wondering if I could change this manually in the distribution but I'm worried if the change won't be overwritten in future deployments by the Ymir platform.

[carlalexander]

I would consider it a bug if it did. Ymir does manage the CloudFront distribution, but it shouldn't overwrite custom things that don't overlap with options from the ymir.yml configuration file.

[carlalexander]

@selul Took a bit, but I'm happy to say that I just added support for it with the origin_shield option. 🥳