# What Gets Deployed: CDN

Source: https://wraps.dev/docs/infrastructure/cdn

Every AWS resource Wraps creates when you run `wraps cdn init`.

## Overview

The CDN service provides S3 + CloudFront for hosting email assets and images. Assets are stored in a private S3 bucket and served globally through CloudFront with HTTPS and edge caching.

architecture.txt

```
# CDN Asset Hosting Architecture## Upload --> S3 Bucket --> CloudFront (Global Edge) --> End Users#                              |#                     Origin Access Identity (OAI)#                              |#                    (Optional) ACM Certificate#                              +#                        Custom Domain## 1. Assets uploaded to private S3 bucket via AWS SDK or CLI# 2. CloudFront serves assets from 400+ global edge locations# 3. OAI ensures S3 is only accessible through CloudFront# 4. Optional custom domain with auto-validated ACM certificate
```

## Core Resources

These resources are always created when you deploy the CDN service.

S3 Bucket`wraps-cdn-{id}`

-   Private bucket (no public access)
-   Versioning enabled for asset history
-   Server-side encryption (AES-256)
-   Unique ID suffix prevents naming conflicts across accounts
-   Stores images, logos, stylesheets, and other email assets

CloudFront Distribution

-   Global edge caching across 400+ locations
-   HTTPS enabled by default (CloudFront certificate)
-   Origin Access Identity (OAI) restricts S3 access to CloudFront only
-   Cache behaviors optimized for static assets (images, CSS, fonts)
-   Gzip and Brotli compression enabled
-   Default TTL of 86,400 seconds (24 hours) for edge caching

IAM Role`wraps-cdn-role`

-   S3 read/write permissions for uploading and managing assets
-   CloudFront invalidation permissions for cache busting
-   OIDC trust policy for Vercel (or IAM trust for AWS-native providers)
-   Scoped to the specific S3 bucket and distribution

## Custom Domain Resources

When you configure a custom domain (e.g., `cdn.yourdomain.com`), these additional resources are created.

ACM Certificate

-   SSL/TLS certificate for your custom domain
-   Auto-validated using DNS (CNAME record)
-   Provisioned in `us-east-1` (CloudFront requirement, regardless of your chosen region)
-   Auto-renewing (managed by AWS)
-   Free of charge (ACM certificates are free for AWS services)

DNS Records

-   CNAME record pointing your custom domain to the CloudFront distribution
-   CNAME record for ACM certificate validation
-   If using Route53, records are created automatically. Otherwise, DNS records are displayed for manual configuration.

Custom domain is optional

Without a custom domain, your assets are served from the default CloudFront URL (e.g., `d1234abcdef8.cloudfront.net`). A custom domain provides a branded URL for your email assets.

## Usage Example

After deploying, use the AWS SDK to upload assets and reference them in your emails.

upload-asset.ts

```
import { readFile } from 'node:fs/promises';import { PutObjectCommand, S3Client } from '@aws-sdk/client-s3';import { WrapsEmail } from '@wraps.dev/email';// The CDN is a plain S3 bucket + CloudFront. Upload with the AWS SDK —// your OIDC role or IAM credentials already have access.const s3 = new S3Client({ region: 'us-east-1' });await s3.send(new PutObjectCommand({  Bucket: 'wraps-cdn-123456789012', // from `wraps cdn status`  Key: 'images/logo.png',  Body: await readFile('./logo.png'),  ContentType: 'image/png',  CacheControl: 'public, max-age=31536000, immutable',}));const url = 'https://cdn.yourdomain.com/images/logo.png';// Reference the CDN URL in your emailsconst email = new WrapsEmail();const result = await email.send({  from: 'hello@yourapp.com',  to: 'user@example.com',  subject: 'Welcome!',  html: `<img src="${url}" alt="Logo" />`,});
```

## Cost Estimate

CDN costs are based on storage and data transfer. All costs are billed directly by AWS.

| Component | Pricing | Notes |
| --- | --- | --- |
| S3 Storage | ~$0.023/GB/mo | Standard storage class |
| CloudFront Data Transfer | ~$0.085/GB | First 10 TB/mo to internet |
| CloudFront Requests | ~$0.01/10K requests | HTTPS requests |
| ACM Certificate | Free | For use with CloudFront |
| CloudFront Invalidation | First 1,000 free/mo | $0.005 per path after |

Typical cost for email assets

Most email use cases (logos, header images, stylesheets) use minimal storage and transfer. Expect less than $1/mo for typical email asset hosting. The AWS Free Tier includes 1 TB of CloudFront data transfer for the first 12 months.

## Resource Tags

All CDN resources are tagged for identification and cost tracking.

| Tag Key | Tag Value | Description |
| --- | --- | --- |
| `ManagedBy` | `wraps-cli` | Identifies resources managed by Wraps |

## Next Steps

CDN CLI Reference

All available CDN CLI commands and options.

[View CLI Docs](https://wraps.dev/docs/cli-reference/cdn)

CDN Quickstart

Deploy CDN infrastructure and upload your first asset.

[Get Started](https://wraps.dev/docs/quickstart/cdn)

Infrastructure as Code

Deploy CDN infrastructure with [CDK](https://wraps.dev/docs/cdk-reference) or [Pulumi](https://wraps.dev/docs/pulumi-reference) instead of the CLI.

[View CDK Docs](https://wraps.dev/docs/cdk-reference)

### Need Help?

If you run into any issues, check our GitHub discussions or open an issue.

[Get Help](https://github.com/wraps-team/wraps/discussions)