sysdesign-cdn-object-store

To configure a CDN in front of object storage for global asset delivery, set the object store as the origin, attach the CDN, and apply per-category cache policies for static and media content across distributed regions.

The best way to handle cache invalidation is applying per-category cache-control strategies: immutable assets use long TTLs, mutable assets use targeted invalidation rules, and private content uses signed URLs or edge authentication.

Signed URLs protect private content on a CDN by generating time-limited, authenticated access tokens at the edge, ensuring only authorized users can retrieve restricted media or downloads from the object store.

Yes, this CDN object store pattern supports public, mutable, and private media content by defining specific origin access methods, per-category cache policies, and signed URL authentication flows for each content type.

Use edge authentication instead of signed URLs when you need centralized access control at the CDN layer rather than distributing time-limited tokens, particularly useful for validating user sessions before reaching object store assets.

Your CDN cache may not update because mutable assets require explicit cache invalidation rules or targeted cache-control headers; without proper per-category invalidation strategies, the edge continues serving stale object store content.