Question

A company serves a website through Amazon CloudFront with an Application Load Balancer origin. Static assets under /static/* are cached correctly, but API responses under /api/* are being served stale and are also ignoring session-specific results because CloudFront caches responses regardless of the Authorization header and query strings. The default cache behavior uses a caching policy with a long TTL. A CloudOps engineer must ensure that /api/* requests always reach the origin with the Authorization header and all query strings forwarded, while keeping /static/* cached. What is the MOST appropriate solution?

Accepted Answer

Create a separate cache behavior for the /api/* path pattern and associate the AWS managed CachingDisabled cache policy along with an origin request policy that forwards the Authorization header and all query strings.

Answer

Reduce the default cache behavior TTL to zero and enable header forwarding for Authorization on the default behavior so both /api/* and /static/* bypass the cache.

Answer

Add an alternate origin for the API and enable origin failover so dynamic requests are routed to the origin only when the cache misses.

Answer

Create a CloudFront function on the viewer request event that deletes cached objects for /api/* and forwards the Authorization header to the origin.