Design a Global Content Delivery Network — System Design Interview Practice

Interview prompt

Design a global CDN that serves static and cacheable dynamic content with low latency, respects cache and authorization semantics, supports edge computation, and shields origins from traffic spikes and attacks.

• Define origin authority, cache keys, TTL, validators, purge, stale serving, signed requests, and personalized-content boundaries.
• Use regional shields, tiered caches, request coalescing, compression, and origin failover while avoiding cache poisoning.
• Keep immutable assets aggressively cacheable and invalidate mutable content by version or tag rather than global flushes.
• Explain DDoS/WAF controls, TLS, geo routing, private content, stale-if-error, observability, and purge correctness.

Requirements and scale assumptions

• Publish assets and cache policies, route requests to the nearest healthy edge, fetch from shield or origin on misses, and purge versions.
• Support static assets, API caching, signed URLs, geographic variants, edge redirects, compression, and conditional requests.
• Expose hit ratio, origin latency, stale serves, purge status, cache-key cardinality, attack traffic, and regional health.
• Target cache hit ratio above 80% and p95 edge response below 100 ms for cacheable content.
• Serve global traffic through distributed edges while isolating hot objects, high-cardinality keys, and abusive clients.
• Make configuration publication and purge operations versioned and retry-safe; never expose private content through a shared key.
• Serve stale safe content or fail over to a secondary origin when an origin or purge service is degraded.
• Serve 10 million requests per second across 200 edge locations with large launch-time traffic spikes.
• Partition cache and shield state by distribution, region, host, and normalized cache key; isolate hot objects.
• Keep edge state bounded with TTL and eviction while retaining configuration, purge, security, and origin audit logs.

• Peak scale: Monitor cache performance — Capacity assumption that drives partitioning and backpressure.
• Latency target: Cache hit ratio above 80% — User-facing budget for the primary request or read path.
• Durable boundary: Committed before async — The source of truth is Serve static and dynamic content globally; Minimize latency for users worldwide.
• Async boundary: At-least-once workers — Keep CloudFront for CDN, S3 as origin for static content, Lambda@Edge for edge computing off the synchronous path.

Key entities

• MediaAssetassetId, ownerId, sourceUri, checksum, privacy, status

  Canonical uploaded global content delivery network asset and lifecycle state.

• MediaRenditionassetId, profile, codec, uri, checksum, status

  Derived global content delivery network output identified by a deterministic profile and content hash.

• PlaybackSessionsessionId, assetId, viewerId, entitlementVersion, edgeRegion, expiresAt

  Short-lived global content delivery network access session that binds authorization to delivery.

• ProcessingJobjobId, assetId, operation, attempt, checkpoint, status

  Retry-safe global content delivery network processing job with checkpoints and per-rendition progress.

Data flow

1. 1. Reserve a resumable uploadThe global content delivery network gateway authenticates the owner, reserves metadata, validates size and checksum, and returns a scoped upload URL.
2. 2. Commit and verify the sourceA completion callback verifies the global content delivery network object, records an immutable checksum, and publishes a processing job only once.
3. 3. Process renditions asynchronouslyWorkers execute global content delivery network transforms with deterministic profiles, checkpointing, bounded retries, and a dead-letter path for corrupt inputs.
4. 4. Publish an entitlement-aware manifestA manifest projection exposes only completed global content delivery network renditions and carries policy, checksum, and freshness metadata.
5. 5. Deliver, invalidate, and recoverCDN delivery is protected by expiring URLs and revocation signals; failed global content delivery network jobs and stale manifests are replayable without duplicating outputs.

Deep dives and trade-offs

• Integrity and idempotent processingUse checksums and immutable source objects for global content delivery network deduplication and audit. Derive output keys from asset, profile, and transform version so retries cannot corrupt a completed rendition. Make completion callbacks and worker claims conditional on job version and attempt.
• Authorization at the edgeBind global content delivery network manifests and signed URLs to the viewer, entitlement version, and expiry. Propagate takedown, privacy, and subscription changes to edge caches with bounded revocation delay. Never let a cache hit bypass the policy decision for private or paid content.
• Cost, hot assets, and backpressureSeparate interactive manifest latency from expensive global content delivery network processing and encode work. Use queue priority, concurrency limits, and lifecycle policies for source and rendition storage. Measure cache hit rate, startup latency, processing backlog, failed bytes, and egress cost by profile.
• Process on upload versus on demandPrecompute common global content delivery network profiles and generate rare profiles on demand with a durable job state. Generating every possible profile up front wastes storage and processing budget.
• Origin storage versus CDN cachingKeep the origin authoritative and use CDN caching for immutable or versioned outputs with explicit invalidation. A cache cannot be the only copy of a global content delivery network rendition or the recovery path becomes undefined.
• Quality versus delivery costChoose profiles from device, bandwidth, and business requirements, then measure quality and egress by cohort. Maximal bitrate or resolution can make tail startup and cost unacceptable without improving viewing outcomes.