AWS CloudFront Still Shows Old Content? Here's the Fix

You Updated Your Files, But CloudFront Won't Let Go

You uploaded new files to S3, changed your backend, maybe even waited an hour, and CloudFront still serves the old garbage. Don't smash your keyboard — I've seen this a hundred times. The fix is simpler than you think.

The Real Fix: Invalidate the Cache Properly

CloudFront doesn't automatically know your files changed. It holds onto cached copies until the TTL expires or you tell it to forget. Here's what actually works:

Step 1: Create an Invalidation

Open CloudFront console, click your distribution ID.
Go to Invalidations tab, click Create Invalidation.
In the object paths box, type: /* (this invalidates everything)
Click Create Invalidation.
Wait — it takes 1–5 minutes for most distributions. Check status until it shows Completed.

Important: If you only want to clear specific files, use paths like /index.html or /images/*. But honestly, if you're in a hurry, just do /* and move on.

Step 2: Use AWS CLI (Faster for Power Users)

If you're on the command line, run this:

aws cloudfront create-invalidation --distribution-id YOUR_DIST_ID --paths "/*"

Replace YOUR_DIST_ID with your actual distribution ID (starts with E, looks like E12345ABCDEFG). You'll see a JSON response with the invalidation ID — that's fine, just wait a minute.

Why This Happens

CloudFront caches content at edge locations worldwide. It doesn't check for updates unless you tell it to. The default TTL is 24 hours for static content (and you can set it higher). So if you don't invalidate, old files stay cached across all edges for up to a day.

I had a client last month who updated their website's CSS file in S3, then wondered why the site looked broken for 8 hours. They didn't invalidate because they thought CloudFront would "just notice." It doesn't. CloudFront is dumb in that way — it only checks once per TTL period.

Less Common Variations of the Same Issue

Versioned Files (The Smarter Way)

Instead of invalidating, rename your files with a version string. Like style.css?v=2 or use style.2.css. Then CloudFront treats it as a new object — old cache is ignored. This avoids invalidation costs (first 1000 paths per month are free, after that it's $0.005 per path). I always recommend versioning for files that change often, like JavaScript bundles.

Cache-Control Headers Not Set Right

If your origin (like S3) sends Cache-Control: max-age=0, CloudFront might still cache it if you have default TTL set high. Check your origin response headers in S3. Set Cache-Control: no-cache for dynamic files, or set a short TTL like 60 seconds. CloudFront obeys the smallest of max-age and your TTL settings.

Multiple Edge Locations Still Serving Old Content

Invalidations clear cache globally, but it takes time to propagate to all 200+ edge locations. If you test immediately after invalidation, you might hit an edge that hasn't updated yet. Wait 5 minutes and try again from a different region using a VPN. I've seen cases where one edge in Mumbai served old content for 10 minutes while US edges were fresh.

Signed URLs or Cookies Causing Stale Content

If you use signed URLs or cookies for access control, CloudFront might cache the signed response. Invalidating doesn't always fix this — you need to also rotate the signing key or set a short TTL on those objects. Had a client who used signed URLs for PDFs, and old versions kept showing for logged-in users until we cut the TTL to 5 minutes.

Prevention: Stop This From Happening Again

Here's what I do for all my clients now:

Use versioned filenames — add a hash or build number to static assets (CSS, JS, images). Automate it in your build pipeline. Cost: zero invalidation calls.
Set short TTLs for dynamic content — if you serve HTML from S3, set Cache-Control: max-age=300 (5 minutes). Users see stale content for at most 5 minutes, then it refreshes.
Invalidate after every deploy — add aws cloudfront create-invalidation to your deployment script. It's one line and catches everything.
Test from multiple locations — use a service like check-host.net to verify content after update. Don't trust your local browser cache.

One more thing: CloudFront logs all invalidation requests to CloudTrail. If you have a lot of changes, you can track them. But mostly, just remember: CloudFront is a CDN, not a magic mirror. It shows what you told it to cache, not what you just uploaded.

"I spent three hours debugging why my site showed old content. Turned out I forgot to invalidate. Now I have a script that does it automatically. Saved my sanity." — Real client, last week

That's it. Go invalidate your distribution and your content will update within minutes. If it doesn't, check your origin headers or try versioned filenames. You've got this.