Does adding Cache-Control through a CloudFront response policy change edge caching?

Definition: No. A CloudFront response headers policy can add Cache-Control to the response sent to a viewer, but AWS documents that this viewer-response header does not affect how CloudFront caches the requested object. Edge cache duration comes from the origin's cache headers together with the cache policy or cache behavior TTL settings.

Key facts

• Amazon CloudFront uses a response headers policy to remove or add HTTP headers in responses sent to viewers, according to its response headers policy reference.
• The response header configuration guide states that a Cache-Control header added through a response headers policy goes to the viewer response only and does not affect how CloudFront caches the requested object.
• CloudFront's cache policy reference says that TTL settings work with Cache-Control and Expires headers when those headers are in the origin response.
• The CloudFront expiration documentation identifies the origin as the place to add Cache-Control with max-age or s-maxage for an individual file's cache duration.

What does the response policy change?

A response headers policy is a response transformation. CloudFront attaches the policy to one or more cache behaviors, then modifies headers in responses that match those behaviors. AWS documents that the policy applies to responses served from the cache as well as responses forwarded from the origin. Its custom-header settings can add a header to every response returned to viewers.

For example, a policy can make this header visible to a browser:

Cache-Control: max-age=3600

That header describes the viewer-facing response produced by the policy. The AWS guide specifically places headers added through this feature in the viewer response and says they do not affect CloudFront's caching of the requested object. The policy can therefore change what a browser receives without changing the object already held at an edge location.

What controls the edge cache duration?

CloudFront documents the cache policy's TTL settings as working with Cache-Control and Expires headers from the origin response. A cache behavior can also use object caching settings that preserve the origin's Cache-Control value, or customize a minimum and maximum duration plus a default duration when the origin response has no Cache-Control header.

With an origin response, the relevant directives include max-age and s-maxage. CloudFront's expiration documentation says that max-age can specify how long an object remains in the cache before CloudFront gets it again from the origin, while s-maxage can specify a different duration for shared caches such as CloudFront. The configured minimum and maximum TTL values constrain the result. A cache policy minimum TTL greater than 0 can also make CloudFront cache content for at least that duration even when the origin response contains Cache-Control: no-cache, no-store, or private.

This gives the two configurations different inputs: a response headers policy changes a viewer response, while an origin header and cache policy determine the edge cache rules. Changing the first does not substitute for changing the second.

What should you change for each goal?

If the goal is browser cache behavior, a response headers policy can add Cache-Control to viewer responses. If the goal is how long CloudFront retains an object, set the cache policy or cache behavior TTL values and configure the origin response headers that CloudFront reads for caching. AWS's cache behavior reference names Minimum TTL, Default TTL, and Maximum TTL as the settings used for these durations.

If the origin already sends Cache-Control, the cache behavior reference provides a "Use Origin Cache Headers" choice when you want to keep that value. If you choose customization, CloudFront uses the configured minimum and maximum values and a default value when the origin response lacks the relevant cache header.

Related terms

• Cache-Control
• Which value wins when CloudFront and the origin set the same custom response header?
• How can CloudFront apply a robots header only to a selected URL path?

FAQ

Does a response policy rewrite the cache object?

No. AWS says headers such as Cache-Control added through a response headers policy go to the viewer response only. The same documentation says those headers do not affect how CloudFront caches the requested object.

Where should an edge cache duration be configured?

Use the origin response headers together with the cache policy or cache behavior TTL settings. CloudFront documents max-age, s-maxage, Minimum TTL, Default TTL, and Maximum TTL as inputs to cache duration.

Can the browser and CloudFront use different durations?

Yes. AWS documents that Cache-Control: max-age and Cache-Control: s-maxage can be used together so objects can remain in CloudFront edge caches for a different duration than in browser caches.

Sources

1. Amazon CloudFront, "Understand response headers policies", undated
2. Amazon CloudFront, "Add or remove HTTP headers in CloudFront responses with a policy", undated
3. Amazon CloudFront, "Understand cache policies", undated
4. Amazon CloudFront, "Manage how long content stays in the cache (expiration)", undated
5. Amazon CloudFront, "Cache behavior settings", undated

---

Check how a page reads to answer engines. Open the GEO score analyzer