CDN Caching Configuration for BIO-QMS Publishing Platform

Overview

This document specifies the Cloud CDN caching architecture and policies for the BIO-QMS documentation publishing platform. The configuration optimizes content delivery while maintaining data freshness requirements for a regulated biosciences quality management system.

Architecture Summary

User Browser
    ↓
Cloud CDN Edge (Global)
    ↓ (cache miss)
Cloud Load Balancer (us-central1)
    ↓
Cloud Run Backend Service (bio-qms-publish)
    ↓
Cloud Storage (static assets) + Firestore (metadata)

Key Design Principles

Aggressive Static Asset Caching: Immutable content-hashed assets cached for 30 days
Conservative Dynamic Caching: HTML documents cached 5 minutes with stale-while-revalidate
Programmatic Invalidation: Deploy triggers purge HTML and search index caches
Edge Security: DDoS protection, rate limiting, and WAF at CDN edge
Cost Optimization: Maximize cache hit ratio to minimize egress from Cloud Run

Cache Policy Matrix

Content Type	TTL	Cache-Control Header	Revalidation	Invalidation Strategy
Static Assets
JS (hashed)	30d	`public, max-age=2592000, immutable`	No	Never (content-hashed)
CSS (hashed)	30d	`public, max-age=2592000, immutable`	No	Never (content-hashed)
Images (PNG/JPG)	30d	`public, max-age=2592000`	No	Never (content-hashed)
Fonts (WOFF2)	30d	`public, max-age=2592000, immutable`	No	Never (content-hashed)
PDF documents	30d	`public, max-age=2592000`	No	Path-based on update
Dynamic Content
HTML pages	5m	`public, max-age=300, stale-while-revalidate=60`	Background	Tag-based on deploy
publish.json	15m	`public, max-age=900, must-revalidate`	Foreground	Path-based on deploy
search-index.json	1h	`public, max-age=3600`	No	Tag-based on rebuild
API Responses
Metadata API	0	`private, no-cache, no-store, must-revalidate`	Always	N/A (not cached)
Auth endpoints	0	`private, no-cache, no-store, must-revalidate`	Always	N/A (not cached)

Cache Key Policy

# Cloud CDN cache key includes:
- Request URI (path + query parameters)
- Host header (for multi-tenant support)
- X-Auth-Mode header (public vs gcp auth)
- Accept-Encoding header (gzip, br)

# Excludes:
- Cookie headers (for public content)
- Authorization headers (bypass cache)
- User-Agent (avoid fragmentation)

Static Asset Caching Strategy

Content Hash Busting

All static assets are built with content hashes in filenames via Vite:

// vite.config.ts
export default defineConfig({
  build: {
    rollupOptions: {
      output: {
        // JS: main-a1b2c3d4.js
        entryFileNames: 'assets/[name]-[hash].js',
        // CSS: style-e5f6g7h8.css
        chunkFileNames: 'assets/[name]-[hash].js',
        assetFileNames: 'assets/[name]-[hash].[ext]'
      }
    }
  }
});

Static Asset Response Headers

# JavaScript (hashed)
Cache-Control: public, max-age=2592000, immutable
Content-Type: application/javascript; charset=utf-8
Content-Encoding: br
ETag: "a1b2c3d4e5f6"
Vary: Accept-Encoding

# CSS (hashed)
Cache-Control: public, max-age=2592000, immutable
Content-Type: text/css; charset=utf-8
Content-Encoding: br
ETag: "g7h8i9j0k1l2"
Vary: Accept-Encoding

# Images (content-hashed filenames)
Cache-Control: public, max-age=2592000
Content-Type: image/png
ETag: "m3n4o5p6q7r8"

# Fonts (WOFF2)
Cache-Control: public, max-age=2592000, immutable
Content-Type: font/woff2
Access-Control-Allow-Origin: *

Implementation in Cloud Run

# src/presentation/cdn.py
from datetime import timedelta
from flask import Response

STATIC_ASSET_EXTENSIONS = {
    '.js': ('application/javascript', timedelta(days=30)),
    '.css': ('text/css', timedelta(days=30)),
    '.png': ('image/png', timedelta(days=30)),
    '.jpg': ('image/jpeg', timedelta(days=30)),
    '.svg': ('image/svg+xml', timedelta(days=30)),
    '.woff2': ('font/woff2', timedelta(days=30)),
    '.pdf': ('application/pdf', timedelta(days=30)),
}

def set_static_cache_headers(response: Response, filename: str) -> Response:
    """Set aggressive caching headers for static assets."""
    ext = os.path.splitext(filename)[1].lower()

    if ext in STATIC_ASSET_EXTENSIONS:
        content_type, max_age = STATIC_ASSET_EXTENSIONS[ext]
        response.headers['Content-Type'] = content_type
        response.headers['Cache-Control'] = (
            f'public, max-age={int(max_age.total_seconds())}, immutable'
        )

        # Enable compression
        if ext in ['.js', '.css', '.svg']:
            response.headers['Vary'] = 'Accept-Encoding'

        # CORS for fonts
        if ext == '.woff2':
            response.headers['Access-Control-Allow-Origin'] = '*'

    return response

HTML Document Caching

Cache Strategy

HTML pages use short TTL (5 minutes) with stale-while-revalidate to balance freshness and performance:

Cache-Control: public, max-age=300, stale-while-revalidate=60

Behavior:

First 5 minutes: Serve from CDN cache (fresh)
5-6 minutes: Serve stale content immediately, revalidate in background
After 6 minutes: Must revalidate before serving

HTML Response Headers

HTTP/2 200 OK
Content-Type: text/html; charset=utf-8
Cache-Control: public, max-age=300, stale-while-revalidate=60
ETag: "W/\"abc123\""
Vary: Accept-Encoding, X-Auth-Mode
X-Cache-Tag: html, deploy-20260216-1430
Content-Encoding: br

Implementation

# src/presentation/cdn.py
def set_html_cache_headers(response: Response, doc_id: str) -> Response:
    """Set caching headers for HTML documents."""
    response.headers['Content-Type'] = 'text/html; charset=utf-8'
    response.headers['Cache-Control'] = (
        'public, max-age=300, stale-while-revalidate=60'
    )

    # Cache tags for invalidation
    deploy_id = os.getenv('K_REVISION', 'unknown')
    response.headers['X-Cache-Tag'] = f'html,deploy-{deploy_id}'

    # Vary by encoding and auth mode
    response.headers['Vary'] = 'Accept-Encoding, X-Auth-Mode'

    # Weak ETag (content may change)
    response.headers['ETag'] = f'W/"{doc_id}-{int(time.time() / 300)}"'

    return response

Cache Invalidation on Deploy

#!/bin/bash
# scripts/invalidate-html-cache.sh

PROJECT_ID="bio-qms-prod"
URL_MAP="bio-qms-cdn"
DEPLOY_REVISION=$(gcloud run services describe bio-qms-publish \
    --region=us-central1 \
    --format='value(status.latestReadyRevisionName)')

# Invalidate all HTML by tag
gcloud compute url-maps invalidate-cdn-cache $URL_MAP \
    --path="/docs/*" \
    --host="docs.bioqms.com" \
    --project=$PROJECT_ID

echo "Invalidated HTML cache for deploy: $DEPLOY_REVISION"

Search Index Caching

Cache Strategy

Search index JSON cached for 1 hour with programmatic purge on rebuild:

Cache-Control: public, max-age=3600
X-Cache-Tag: search-index, search-index-v123

Search Index Response Headers

HTTP/2 200 OK
Content-Type: application/json; charset=utf-8
Cache-Control: public, max-age=3600
ETag: "search-index-v123"
X-Cache-Tag: search-index, search-index-v123
Content-Encoding: br
Content-Length: 45678

Implementation

# src/presentation/search.py
from flask import Response, jsonify

def get_search_index() -> Response:
    """Serve search index with 1-hour caching."""
    # Load from Firestore or Cloud Storage
    index_data = load_search_index()
    index_version = index_data.get('version', 'unknown')

    response = jsonify(index_data)
    response.headers['Cache-Control'] = 'public, max-age=3600'
    response.headers['X-Cache-Tag'] = f'search-index,search-index-v{index_version}'
    response.headers['ETag'] = f'"search-index-v{index_version}"'

    return response

Programmatic Cache Purge on Rebuild

# src/presentation/search_indexer.py
from google.cloud import compute_v1

def rebuild_search_index(project_id: str):
    """Rebuild search index and purge CDN cache."""
    # Build new index
    new_index = build_index()
    new_version = new_index['version']

    # Save to storage
    save_search_index(new_index)

    # Purge CDN cache
    invalidate_cdn_cache(
        project_id=project_id,
        url_map="bio-qms-cdn",
        path="/api/search/index.json",
        host="docs.bioqms.com"
    )

    print(f"Search index rebuilt: v{new_version}, cache purged")

def invalidate_cdn_cache(project_id: str, url_map: str, path: str, host: str):
    """Invalidate Cloud CDN cache for specific path."""
    client = compute_v1.UrlMapsClient()

    request = compute_v1.InvalidateCacheUrlMapRequest(
        project=project_id,
        url_map=url_map,
        cache_invalidation_rule_resource=compute_v1.CacheInvalidationRule(
            path=path,
            host=host
        )
    )

    operation = client.invalidate_cache(request=request)
    operation.result()  # Wait for completion

publish.json Caching

Cache Strategy

Metadata file cached 15 minutes with mandatory revalidation:

Cache-Control: public, max-age=900, must-revalidate

Response Headers

HTTP/2 200 OK
Content-Type: application/json; charset=utf-8
Cache-Control: public, max-age=900, must-revalidate
ETag: "publish-json-v456"
X-Cache-Tag: publish-json
Last-Modified: Wed, 16 Feb 2026 14:30:00 GMT
Content-Encoding: br

Implementation

# src/presentation/metadata.py
def get_publish_json() -> Response:
    """Serve publish.json with 15-minute caching."""
    publish_data = load_publish_metadata()

    response = jsonify(publish_data)
    response.headers['Cache-Control'] = 'public, max-age=900, must-revalidate'
    response.headers['X-Cache-Tag'] = 'publish-json'

    # ETag from content hash
    content_hash = hashlib.sha256(
        json.dumps(publish_data, sort_keys=True).encode()
    ).hexdigest()[:12]
    response.headers['ETag'] = f'"publish-json-{content_hash}"'

    return response

Cloud CDN Configuration

Backend Service Configuration

# Create backend service for Cloud Run
gcloud compute backend-services create bio-qms-publish-backend \
    --global \
    --load-balancing-scheme=EXTERNAL_MANAGED \
    --protocol=HTTPS \
    --enable-cdn \
    --cache-mode=CACHE_ALL_STATIC \
    --default-ttl=300 \
    --max-ttl=2592000 \
    --client-ttl=300 \
    --serve-while-stale=60

# Add Cloud Run NEG as backend
gcloud compute backend-services add-backend bio-qms-publish-backend \
    --global \
    --network-endpoint-group=bio-qms-publish-neg \
    --network-endpoint-group-region=us-central1

Cache Key Policy

# Configure cache key to include specific headers
gcloud compute backend-services update bio-qms-publish-backend \
    --global \
    --cache-key-include-host \
    --cache-key-include-protocol \
    --cache-key-include-query-string \
    --cache-key-query-string-whitelist="version,page,q" \
    --custom-request-header="X-Auth-Mode:{auth_mode}"

URL Map Configuration

# Create URL map with path-based routing
gcloud compute url-maps create bio-qms-cdn \
    --default-service=bio-qms-publish-backend

# Add path matcher for static assets
gcloud compute url-maps add-path-matcher bio-qms-cdn \
    --path-matcher-name=static-assets \
    --default-service=bio-qms-publish-backend \
    --path-rules="/assets/*=bio-qms-publish-backend,/static/*=bio-qms-publish-backend"

SSL Certificate

# Create managed SSL certificate
gcloud compute ssl-certificates create bio-qms-ssl \
    --domains=docs.bioqms.com \
    --global

# Create HTTPS proxy
gcloud compute target-https-proxies create bio-qms-https-proxy \
    --url-map=bio-qms-cdn \
    --ssl-certificates=bio-qms-ssl

# Create forwarding rule
gcloud compute forwarding-rules create bio-qms-https-rule \
    --global \
    --target-https-proxy=bio-qms-https-proxy \
    --ports=443 \
    --load-balancing-scheme=EXTERNAL_MANAGED \
    --network-tier=PREMIUM

Terraform Configuration

Complete CDN Setup

# terraform/cdn.tf

# Backend Service
resource "google_compute_backend_service" "bio_qms_publish" {
  name                  = "bio-qms-publish-backend"
  protocol              = "HTTPS"
  load_balancing_scheme = "EXTERNAL_MANAGED"
  timeout_sec          = 30
  enable_cdn           = true

  cdn_policy {
    cache_mode                   = "CACHE_ALL_STATIC"
    default_ttl                  = 300      # 5 minutes
    max_ttl                      = 2592000  # 30 days
    client_ttl                   = 300      # 5 minutes
    serve_while_stale            = 60       # 1 minute
    negative_caching             = true

    # Cache only successful responses
    negative_caching_policy {
      code = 404
      ttl  = 60
    }

    negative_caching_policy {
      code = 500
      ttl  = 0
    }

    cache_key_policy {
      include_host           = true
      include_protocol       = true
      include_query_string   = true
      query_string_whitelist = ["version", "page", "q"]

      # Custom headers for cache key
      include_named_cookies = []
    }
  }

  backend {
    group                        = google_compute_region_network_endpoint_group.bio_qms_publish.id
    balancing_mode              = "UTILIZATION"
    capacity_scaler             = 1.0
    max_utilization             = 0.8
  }

  log_config {
    enable      = true
    sample_rate = 1.0
  }

  security_policy = google_compute_security_policy.bio_qms_cdn.id
}

# Cloud Run NEG
resource "google_compute_region_network_endpoint_group" "bio_qms_publish" {
  name                  = "bio-qms-publish-neg"
  network_endpoint_type = "SERVERLESS"
  region                = var.region

  cloud_run {
    service = google_cloud_run_service.bio_qms_publish.name
  }
}

# URL Map
resource "google_compute_url_map" "bio_qms_cdn" {
  name            = "bio-qms-cdn"
  default_service = google_compute_backend_service.bio_qms_publish.id

  host_rule {
    hosts        = ["docs.bioqms.com"]
    path_matcher = "main"
  }

  path_matcher {
    name            = "main"
    default_service = google_compute_backend_service.bio_qms_publish.id

    # Static assets - aggressive caching
    path_rule {
      paths   = ["/assets/*", "/static/*"]
      service = google_compute_backend_service.bio_qms_publish.id

      route_action {
        cors_policy {
          allow_origins        = ["*"]
          allow_methods        = ["GET", "HEAD"]
          allow_headers        = ["Content-Type"]
          max_age              = 3600
        }
      }
    }
  }
}

# SSL Certificate
resource "google_compute_managed_ssl_certificate" "bio_qms" {
  name = "bio-qms-ssl"

  managed {
    domains = ["docs.bioqms.com"]
  }
}

# HTTPS Proxy
resource "google_compute_target_https_proxy" "bio_qms" {
  name             = "bio-qms-https-proxy"
  url_map          = google_compute_url_map.bio_qms_cdn.id
  ssl_certificates = [google_compute_managed_ssl_certificate.bio_qms.id]

  # Enable QUIC (HTTP/3)
  quic_override = "ENABLE"
}

# Global Forwarding Rule
resource "google_compute_global_forwarding_rule" "bio_qms_https" {
  name                  = "bio-qms-https-rule"
  target                = google_compute_target_https_proxy.bio_qms.id
  port_range            = "443"
  load_balancing_scheme = "EXTERNAL_MANAGED"
  ip_address            = google_compute_global_address.bio_qms.id
}

# Static IP
resource "google_compute_global_address" "bio_qms" {
  name         = "bio-qms-cdn-ip"
  address_type = "EXTERNAL"
  ip_version   = "IPV4"
}

# HTTP to HTTPS Redirect
resource "google_compute_url_map" "bio_qms_redirect" {
  name = "bio-qms-http-redirect"

  default_url_redirect {
    https_redirect         = true
    redirect_response_code = "MOVED_PERMANENTLY_DEFAULT"
    strip_query            = false
  }
}

resource "google_compute_target_http_proxy" "bio_qms_redirect" {
  name    = "bio-qms-http-proxy"
  url_map = google_compute_url_map.bio_qms_redirect.id
}

resource "google_compute_global_forwarding_rule" "bio_qms_http" {
  name                  = "bio-qms-http-rule"
  target                = google_compute_target_http_proxy.bio_qms_redirect.id
  port_range            = "80"
  load_balancing_scheme = "EXTERNAL_MANAGED"
  ip_address            = google_compute_global_address.bio_qms.id
}

Cloud Armor Security Policy

# terraform/security.tf
resource "google_compute_security_policy" "bio_qms_cdn" {
  name        = "bio-qms-cdn-security"
  description = "Cloud Armor policy for BIO-QMS CDN"

  # Rate limiting: 100 requests per minute per IP
  rule {
    action   = "rate_based_ban"
    priority = 100

    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }

    rate_limit_options {
      conform_action = "allow"
      exceed_action  = "deny(429)"

      enforce_on_key = "IP"

      rate_limit_threshold {
        count        = 100
        interval_sec = 60
      }

      ban_duration_sec = 600  # 10 minute ban
    }
  }

  # Block known bad bots
  rule {
    action   = "deny(403)"
    priority = 200

    match {
      expr {
        expression = "request.headers['user-agent'].contains('BadBot')"
      }
    }
  }

  # OWASP ModSecurity Core Rule Set
  rule {
    action   = "deny(403)"
    priority = 300

    match {
      expr {
        expression = "evaluatePreconfiguredExpr('xss-stable')"
      }
    }
  }

  rule {
    action   = "deny(403)"
    priority = 301

    match {
      expr {
        expression = "evaluatePreconfiguredExpr('sqli-stable')"
      }
    }
  }

  # Allow all other traffic
  rule {
    action   = "allow"
    priority = 2147483647

    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }
  }

  # Adaptive Protection (DDoS)
  adaptive_protection_config {
    layer_7_ddos_defense_config {
      enable = true
    }
  }
}

Cache Invalidation Strategies

1. Tag-Based Invalidation (Recommended)

Invalidate multiple related resources by cache tag:

# Invalidate all HTML after deploy
gcloud compute url-maps invalidate-cdn-cache bio-qms-cdn \
    --tags="html,deploy-20260216-1430" \
    --project=bio-qms-prod

Python Implementation:

# src/infrastructure/cdn_invalidation.py
from google.cloud import compute_v1
from typing import List

def invalidate_by_tags(
    project_id: str,
    url_map: str,
    tags: List[str]
) -> None:
    """Invalidate CDN cache by tags."""
    client = compute_v1.UrlMapsClient()

    request = compute_v1.InvalidateCacheUrlMapRequest(
        project=project_id,
        url_map=url_map,
        cache_invalidation_rule_resource=compute_v1.CacheInvalidationRule(
            tags=tags
        )
    )

    operation = client.invalidate_cache(request=request)
    operation.result()
    print(f"Invalidated cache for tags: {tags}")

2. Path-Based Invalidation

Invalidate specific paths or wildcards:

# Invalidate single document
gcloud compute url-maps invalidate-cdn-cache bio-qms-cdn \
    --path="/docs/sop/manufacturing-001.html" \
    --host="docs.bioqms.com"

# Invalidate entire section
gcloud compute url-maps invalidate-cdn-cache bio-qms-cdn \
    --path="/docs/sop/*" \
    --host="docs.bioqms.com"

Python Implementation:

def invalidate_by_path(
    project_id: str,
    url_map: str,
    path: str,
    host: str = "docs.bioqms.com"
) -> None:
    """Invalidate CDN cache by path pattern."""
    client = compute_v1.UrlMapsClient()

    request = compute_v1.InvalidateCacheUrlMapRequest(
        project=project_id,
        url_map=url_map,
        cache_invalidation_rule_resource=compute_v1.CacheInvalidationRule(
            path=path,
            host=host
        )
    )

    operation = client.invalidate_cache(request=request)
    operation.result()
    print(f"Invalidated cache for path: {path}")

3. Deploy-Triggered Invalidation

Automatically purge cache on Cloud Run deployment:

# cloudbuild.yaml
steps:
  # Build and deploy Cloud Run service
  - name: 'gcr.io/cloud-builders/gcloud'
    args:
      - 'run'
      - 'deploy'
      - 'bio-qms-publish'
      - '--image=gcr.io/$PROJECT_ID/bio-qms-publish:$SHORT_SHA'
      - '--region=us-central1'
      - '--platform=managed'
    id: 'deploy-service'

  # Invalidate HTML cache
  - name: 'gcr.io/cloud-builders/gcloud'
    args:
      - 'compute'
      - 'url-maps'
      - 'invalidate-cdn-cache'
      - 'bio-qms-cdn'
      - '--path=/docs/*'
      - '--host=docs.bioqms.com'
    id: 'invalidate-html'
    waitFor: ['deploy-service']

  # Invalidate search index
  - name: 'gcr.io/cloud-builders/gcloud'
    args:
      - 'compute'
      - 'url-maps'
      - 'invalidate-cdn-cache'
      - 'bio-qms-cdn'
      - '--path=/api/search/index.json'
      - '--host=docs.bioqms.com'
    id: 'invalidate-search'
    waitFor: ['deploy-service']

4. Automated Invalidation Script

# scripts/invalidate_cdn.py
import argparse
import os
from google.cloud import compute_v1

def main():
    parser = argparse.ArgumentParser(
        description='Invalidate Cloud CDN cache for BIO-QMS'
    )
    parser.add_argument(
        '--strategy',
        choices=['html', 'search', 'all', 'path', 'tags'],
        required=True,
        help='Invalidation strategy'
    )
    parser.add_argument('--path', help='Path pattern for path-based invalidation')
    parser.add_argument('--tags', help='Comma-separated tags for tag-based invalidation')

    args = parser.parse_args()

    project_id = os.getenv('GCP_PROJECT_ID', 'bio-qms-prod')
    url_map = 'bio-qms-cdn'
    host = 'docs.bioqms.com'

    client = compute_v1.UrlMapsClient()

    if args.strategy == 'html':
        invalidate_html(client, project_id, url_map, host)
    elif args.strategy == 'search':
        invalidate_search(client, project_id, url_map, host)
    elif args.strategy == 'all':
        invalidate_all(client, project_id, url_map, host)
    elif args.strategy == 'path':
        if not args.path:
            parser.error('--path required for path-based invalidation')
        invalidate_path(client, project_id, url_map, host, args.path)
    elif args.strategy == 'tags':
        if not args.tags:
            parser.error('--tags required for tag-based invalidation')
        tags = [t.strip() for t in args.tags.split(',')]
        invalidate_tags(client, project_id, url_map, tags)

def invalidate_html(client, project_id, url_map, host):
    """Invalidate all HTML documents."""
    print("Invalidating HTML cache...")
    request = compute_v1.InvalidateCacheUrlMapRequest(
        project=project_id,
        url_map=url_map,
        cache_invalidation_rule_resource=compute_v1.CacheInvalidationRule(
            path="/docs/*",
            host=host
        )
    )
    operation = client.invalidate_cache(request=request)
    operation.result()
    print("✓ HTML cache invalidated")

def invalidate_search(client, project_id, url_map, host):
    """Invalidate search index."""
    print("Invalidating search index cache...")
    request = compute_v1.InvalidateCacheUrlMapRequest(
        project=project_id,
        url_map=url_map,
        cache_invalidation_rule_resource=compute_v1.CacheInvalidationRule(
            path="/api/search/index.json",
            host=host
        )
    )
    operation = client.invalidate_cache(request=request)
    operation.result()
    print("✓ Search index cache invalidated")

def invalidate_all(client, project_id, url_map, host):
    """Invalidate entire cache."""
    print("Invalidating entire cache...")
    request = compute_v1.InvalidateCacheUrlMapRequest(
        project=project_id,
        url_map=url_map,
        cache_invalidation_rule_resource=compute_v1.CacheInvalidationRule(
            path="/*",
            host=host
        )
    )
    operation = client.invalidate_cache(request=request)
    operation.result()
    print("✓ Entire cache invalidated")

if __name__ == '__main__':
    main()

Usage:

# Invalidate HTML after content update
python scripts/invalidate_cdn.py --strategy=html

# Invalidate search index after rebuild
python scripts/invalidate_cdn.py --strategy=search

# Invalidate specific path
python scripts/invalidate_cdn.py --strategy=path --path="/docs/sop/manufacturing-001.html"

# Invalidate by tags
python scripts/invalidate_cdn.py --strategy=tags --tags="html,deploy-20260216-1430"

Signed URLs for Time-Limited Access

For documents with auth_mode: gcp, generate signed URLs for time-limited CDN access:

Implementation

# src/auth/signed_urls.py
import base64
import datetime
import hashlib
import hmac
from urllib.parse import quote

def generate_signed_url(
    url: str,
    key_name: str,
    key_secret: str,
    expiration_seconds: int = 3600
) -> str:
    """
    Generate Cloud CDN signed URL.

    Args:
        url: Base URL (e.g., "https://docs.bioqms.com/docs/sop/manufacturing-001.html")
        key_name: CDN signing key name
        key_secret: Base64-encoded signing key secret
        expiration_seconds: URL validity duration (default 1 hour)

    Returns:
        Signed URL with expiration and signature
    """
    # Calculate expiration timestamp
    expiration = int(
        (datetime.datetime.utcnow() + datetime.timedelta(seconds=expiration_seconds))
        .timestamp()
    )

    # Build URL to sign
    url_to_sign = f"URLPrefix={url}&Expires={expiration}&KeyName={key_name}"

    # Decode key secret
    key_bytes = base64.urlsafe_b64decode(key_secret)

    # Calculate signature
    signature = base64.urlsafe_b64encode(
        hmac.new(
            key_bytes,
            url_to_sign.encode('utf-8'),
            hashlib.sha1
        ).digest()
    ).decode('utf-8')

    # Build signed URL
    signed_url = f"{url}?Expires={expiration}&KeyName={key_name}&Signature={signature}"

    return signed_url

# Usage example
def get_authenticated_document_url(doc_id: str, user_id: str) -> str:
    """Generate signed URL for authenticated document access."""
    # Verify user has access
    if not user_has_access(user_id, doc_id):
        raise PermissionError(f"User {user_id} cannot access {doc_id}")

    # Get signing key from Secret Manager
    key_name = "bio-qms-cdn-key"
    key_secret = get_secret("bio-qms-cdn-key-secret")

    # Build base URL
    base_url = f"https://docs.bioqms.com/docs/{doc_id}.html"

    # Generate signed URL (1 hour expiration)
    signed_url = generate_signed_url(
        url=base_url,
        key_name=key_name,
        key_secret=key_secret,
        expiration_seconds=3600
    )

    return signed_url

CDN Signing Key Setup

# Generate signing key
head -c 16 /dev/urandom | base64 | tr +/ -_ | tr -d = > cdn-key-secret.txt

# Create signing key in GCP
gcloud compute sign-url-keys create bio-qms-cdn-key \
    --backend-service=bio-qms-publish-backend \
    --key-file=cdn-key-secret.txt

# Store secret in Secret Manager
gcloud secrets create bio-qms-cdn-key-secret \
    --data-file=cdn-key-secret.txt \
    --replication-policy=automatic

# Clean up local key file
shred -u cdn-key-secret.txt

Edge Security

DDoS Protection

Cloud Armor Adaptive Protection automatically detects and mitigates Layer 7 DDoS attacks:

# terraform/security.tf (continued)
resource "google_compute_security_policy" "bio_qms_cdn" {
  # ... (previous rules)

  adaptive_protection_config {
    layer_7_ddos_defense_config {
      enable          = true
      rule_visibility = "STANDARD"
    }
  }
}

Rate Limiting

Prevent abuse with per-IP rate limiting:

resource "google_compute_security_policy_rule" "rate_limit" {
  security_policy = google_compute_security_policy.bio_qms_cdn.name
  priority        = 100
  action          = "rate_based_ban"

  match {
    versioned_expr = "SRC_IPS_V1"
    config {
      src_ip_ranges = ["*"]
    }
  }

  rate_limit_options {
    conform_action = "allow"
    exceed_action  = "deny(429)"
    enforce_on_key = "IP"

    rate_limit_threshold {
      count        = 100
      interval_sec = 60
    }

    ban_duration_sec = 600
  }
}

WAF Rules

Block common attacks with OWASP Core Rule Set:

# XSS protection
resource "google_compute_security_policy_rule" "xss" {
  security_policy = google_compute_security_policy.bio_qms_cdn.name
  priority        = 300
  action          = "deny(403)"

  match {
    expr {
      expression = "evaluatePreconfiguredExpr('xss-stable')"
    }
  }
}

# SQL injection protection
resource "google_compute_security_policy_rule" "sqli" {
  security_policy = google_compute_security_policy.bio_qms_cdn.name
  priority        = 301
  action          = "deny(403)"

  match {
    expr {
      expression = "evaluatePreconfiguredExpr('sqli-stable')"
    }
  }
}

# Local/remote file inclusion
resource "google_compute_security_policy_rule" "lfi" {
  security_policy = google_compute_security_policy.bio_qms_cdn.name
  priority        = 302
  action          = "deny(403)"

  match {
    expr {
      expression = "evaluatePreconfiguredExpr('lfi-stable')"
    }
  }
}

# Remote code execution
resource "google_compute_security_policy_rule" "rce" {
  security_policy = google_compute_security_policy.bio_qms_cdn.name
  priority        = 303
  action          = "deny(403)"

  match {
    expr {
      expression = "evaluatePreconfiguredExpr('rce-stable')"
    }
  }
}

Performance Targets

Service Level Objectives (SLOs)

Metric	Target	Measurement
TTFB from CDN edge	< 100ms	p95 response time
Cache hit ratio	> 95%	CDN cache hits / total requests
HTML page load	< 1s	p95 end-to-end load time
Static asset load	< 200ms	p95 response time
Search index load	< 300ms	p95 response time
Availability	99.9%	Uptime (excluding maintenance)

Cache Performance Metrics

-- BigQuery query for cache hit ratio
SELECT
  DATE(timestamp) AS date,
  COUNTIF(cache_hit) / COUNT(*) AS cache_hit_ratio,
  COUNTIF(cache_hit) AS cache_hits,
  COUNTIF(NOT cache_hit) AS cache_misses,
  COUNT(*) AS total_requests
FROM
  `bio-qms-prod.cdn_logs.requests`
WHERE
  DATE(timestamp) >= CURRENT_DATE() - 7
  AND status_code BETWEEN 200 AND 299
GROUP BY
  date
ORDER BY
  date DESC;

Latency Distribution

-- p50, p95, p99 TTFB by content type
SELECT
  request_path_type,
  APPROX_QUANTILES(ttfb_ms, 100)[OFFSET(50)] AS p50_ttfb,
  APPROX_QUANTILES(ttfb_ms, 100)[OFFSET(95)] AS p95_ttfb,
  APPROX_QUANTILES(ttfb_ms, 100)[OFFSET(99)] AS p99_ttfb,
  AVG(ttfb_ms) AS avg_ttfb,
  COUNT(*) AS request_count
FROM
  `bio-qms-prod.cdn_logs.requests`
WHERE
  DATE(timestamp) = CURRENT_DATE()
  AND cache_hit = TRUE
GROUP BY
  request_path_type
ORDER BY
  request_count DESC;

Monitoring and Metrics

Cloud Monitoring Dashboards

# monitoring/cdn-dashboard.yaml
displayName: "BIO-QMS CDN Performance"
gridLayout:
  widgets:
    # Cache Hit Ratio
    - title: "Cache Hit Ratio (7d)"
      xyChart:
        dataSets:
          - timeSeriesQuery:
              timeSeriesFilter:
                filter: |
                  resource.type="https_lb_rule"
                  resource.labels.url_map_name="bio-qms-cdn"
                  metric.type="loadbalancing.googleapis.com/https/request_count"
                aggregation:
                  alignmentPeriod: "3600s"
                  perSeriesAligner: "ALIGN_RATE"
                  groupByFields: ["metric.label.cache_result"]
        yAxis:
          label: "Requests/sec"

    # Bandwidth Usage
    - title: "Bandwidth (Egress)"
      xyChart:
        dataSets:
          - timeSeriesQuery:
              timeSeriesFilter:
                filter: |
                  resource.type="https_lb_rule"
                  metric.type="loadbalancing.googleapis.com/https/response_bytes_count"
                aggregation:
                  alignmentPeriod: "3600s"
                  perSeriesAligner: "ALIGN_RATE"
        yAxis:
          label: "Bytes/sec"

    # Latency Distribution
    - title: "Backend Latency (p50, p95, p99)"
      xyChart:
        dataSets:
          - timeSeriesQuery:
              timeSeriesFilter:
                filter: |
                  resource.type="https_lb_rule"
                  metric.type="loadbalancing.googleapis.com/https/backend_latencies"
                aggregation:
                  alignmentPeriod: "300s"
                  perSeriesAligner: "ALIGN_DELTA"
                  crossSeriesReducer: "REDUCE_PERCENTILE_50"
        yAxis:
          label: "Latency (ms)"

    # Error Rate
    - title: "5xx Error Rate"
      xyChart:
        dataSets:
          - timeSeriesQuery:
              timeSeriesFilter:
                filter: |
                  resource.type="https_lb_rule"
                  metric.type="loadbalancing.googleapis.com/https/request_count"
                  metric.labels.response_code_class="500"
                aggregation:
                  alignmentPeriod: "300s"
                  perSeriesAligner: "ALIGN_RATE"
        yAxis:
          label: "Errors/sec"

Alerting Policies

# monitoring/cdn-alerts.yaml
displayName: "BIO-QMS CDN Alerts"
conditions:
  # Low cache hit ratio
  - displayName: "Cache Hit Ratio < 90%"
    conditionThreshold:
      filter: |
        resource.type="https_lb_rule"
        resource.labels.url_map_name="bio-qms-cdn"
        metric.type="loadbalancing.googleapis.com/https/request_count"
      aggregations:
        - alignmentPeriod: "300s"
          perSeriesAligner: "ALIGN_RATE"
          groupByFields: ["metric.label.cache_result"]
      comparison: "COMPARISON_LT"
      thresholdValue: 0.90
      duration: "600s"

  # High error rate
  - displayName: "5xx Error Rate > 1%"
    conditionThreshold:
      filter: |
        resource.type="https_lb_rule"
        metric.type="loadbalancing.googleapis.com/https/request_count"
        metric.labels.response_code_class="500"
      aggregations:
        - alignmentPeriod: "300s"
          perSeriesAligner: "ALIGN_RATE"
      comparison: "COMPARISON_GT"
      thresholdValue: 0.01
      duration: "300s"

  # High latency
  - displayName: "p95 TTFB > 500ms"
    conditionThreshold:
      filter: |
        resource.type="https_lb_rule"
        metric.type="loadbalancing.googleapis.com/https/total_latencies"
      aggregations:
        - alignmentPeriod: "300s"
          perSeriesAligner: "ALIGN_DELTA"
          crossSeriesReducer: "REDUCE_PERCENTILE_95"
      comparison: "COMPARISON_GT"
      thresholdValue: 500
      duration: "600s"

notificationChannels:
  - projects/bio-qms-prod/notificationChannels/email-ops
  - projects/bio-qms-prod/notificationChannels/pagerduty

Custom Metrics

# src/monitoring/cdn_metrics.py
from google.cloud import monitoring_v3
import time

def record_cache_performance(
    project_id: str,
    cache_hit: bool,
    ttfb_ms: float,
    content_type: str
):
    """Record custom CDN performance metrics."""
    client = monitoring_v3.MetricServiceClient()
    project_name = f"projects/{project_id}"

    # Cache hit metric
    series = monitoring_v3.TimeSeries()
    series.metric.type = "custom.googleapis.com/cdn/cache_hit"
    series.resource.type = "generic_task"
    series.resource.labels["project_id"] = project_id
    series.resource.labels["task_id"] = "cdn"

    point = monitoring_v3.Point()
    point.value.int64_value = 1 if cache_hit else 0
    point.interval.end_time.seconds = int(time.time())
    series.points = [point]

    client.create_time_series(name=project_name, time_series=[series])

    # TTFB metric
    series = monitoring_v3.TimeSeries()
    series.metric.type = "custom.googleapis.com/cdn/ttfb"
    series.metric.labels["content_type"] = content_type
    series.resource.type = "generic_task"
    series.resource.labels["project_id"] = project_id
    series.resource.labels["task_id"] = "cdn"

    point = monitoring_v3.Point()
    point.value.double_value = ttfb_ms
    point.interval.end_time.seconds = int(time.time())
    series.points = [point]

    client.create_time_series(name=project_name, time_series=[series])

Cost Optimization

Egress Cost Analysis

Cloud CDN egress pricing (as of 2026):

Region	Price (per GB)
North America	$0.08
Europe	$0.08
Asia	$0.12
Australia	$0.15
China	$0.23

Cache hit savings:

Monthly egress without CDN: 1TB @ $0.08/GB = $80
Monthly egress with 95% cache hit: 50GB @ $0.08/GB = $4
Monthly savings: $76 (95%)

Cost Monitoring Query

-- Estimate monthly CDN costs
WITH daily_traffic AS (
  SELECT
    DATE(timestamp) AS date,
    SUM(response_bytes) / POW(1024, 3) AS egress_gb,
    COUNTIF(cache_hit) / COUNT(*) AS cache_hit_ratio
  FROM
    `bio-qms-prod.cdn_logs.requests`
  WHERE
    DATE(timestamp) >= CURRENT_DATE() - 30
  GROUP BY
    date
)
SELECT
  SUM(egress_gb) AS total_egress_gb,
  AVG(cache_hit_ratio) AS avg_cache_hit_ratio,
  SUM(egress_gb) * 0.08 AS estimated_cost_usd,
  SUM(egress_gb * (1 - cache_hit_ratio)) * 0.08 AS actual_cost_usd,
  SUM(egress_gb * cache_hit_ratio) * 0.08 AS saved_cost_usd
FROM
  daily_traffic;

Cache Efficiency Optimization

Maximize static asset caching (already at 30 days)
Increase HTML cache TTL if acceptable (currently 5 minutes)
Pre-warm cache for popular documents
Compress responses (Brotli > gzip)
Optimize image formats (WebP, AVIF)

Multi-Region Considerations

Cloud CDN Edge Locations

Cloud CDN automatically serves content from the nearest edge location:

North America: 25+ locations (US, Canada, Mexico)
Europe: 30+ locations
Asia: 35+ locations
South America: 5+ locations
Africa: 2+ locations
Oceania: 3+ locations

Region-Specific Caching

Different regions may require different cache policies:

# src/presentation/regional_cache.py
def get_cache_control_by_region(region: str, content_type: str) -> str:
    """Get cache-control header based on user region."""
    # Longer TTL for regions far from origin (us-central1)
    distant_regions = ['asia', 'oceania', 'africa']

    if content_type == 'text/html':
        if any(r in region.lower() for r in distant_regions):
            # 10 minutes for distant regions
            return 'public, max-age=600, stale-while-revalidate=120'
        else:
            # 5 minutes for nearby regions
            return 'public, max-age=300, stale-while-revalidate=60'

    # Static assets same for all regions
    return 'public, max-age=2592000, immutable'

Cache Pre-Warming

Pre-populate CDN cache in all regions after deploy:

# scripts/prewarm_cdn.py
import requests
import concurrent.futures
from typing import List

# Cloud CDN anycast IPs for each region
CDN_ENDPOINTS = [
    'https://docs.bioqms.com',  # Anycast (auto-routes to nearest edge)
]

# Popular documents to pre-warm
POPULAR_DOCS = [
    '/docs/index.html',
    '/docs/sop/manufacturing-001.html',
    '/docs/quality/qms-overview.html',
    '/api/search/index.json',
    '/assets/main-*.js',  # Latest hashed JS
    '/assets/style-*.css',  # Latest hashed CSS
]

def prewarm_cache(endpoint: str, paths: List[str]):
    """Pre-warm CDN cache by fetching documents."""
    with concurrent.futures.ThreadPoolExecutor(max_workers=10) as executor:
        futures = []
        for path in paths:
            url = f"{endpoint}{path}"
            futures.append(executor.submit(requests.head, url))

        concurrent.futures.wait(futures)

    print(f"Pre-warmed {len(paths)} documents at {endpoint}")

if __name__ == '__main__':
    for endpoint in CDN_ENDPOINTS:
        prewarm_cache(endpoint, POPULAR_DOCS)

Testing Strategy

Cache Behavior Verification

#!/bin/bash
# scripts/test_cdn_cache.sh

BASE_URL="https://docs.bioqms.com"

# Test 1: Static asset caching (30 days)
echo "Test 1: Static asset caching"
RESPONSE=$(curl -I "$BASE_URL/assets/main-a1b2c3d4.js" 2>/dev/null)
echo "$RESPONSE" | grep "Cache-Control: public, max-age=2592000, immutable"
if [ $? -eq 0 ]; then
    echo "✓ Static asset cache headers correct"
else
    echo "✗ Static asset cache headers incorrect"
fi

# Test 2: HTML caching (5 minutes)
echo -e "\nTest 2: HTML caching"
RESPONSE=$(curl -I "$BASE_URL/docs/index.html" 2>/dev/null)
echo "$RESPONSE" | grep "Cache-Control: public, max-age=300"
if [ $? -eq 0 ]; then
    echo "✓ HTML cache headers correct"
else
    echo "✗ HTML cache headers incorrect"
fi

# Test 3: Search index caching (1 hour)
echo -e "\nTest 3: Search index caching"
RESPONSE=$(curl -I "$BASE_URL/api/search/index.json" 2>/dev/null)
echo "$RESPONSE" | grep "Cache-Control: public, max-age=3600"
if [ $? -eq 0 ]; then
    echo "✓ Search index cache headers correct"
else
    echo "✗ Search index cache headers incorrect"
fi

# Test 4: CDN cache hit
echo -e "\nTest 4: CDN cache hit"
FIRST=$(curl -I "$BASE_URL/docs/index.html" 2>/dev/null | grep -i "x-cache")
sleep 2
SECOND=$(curl -I "$BASE_URL/docs/index.html" 2>/dev/null | grep -i "x-cache")
echo "First request: $FIRST"
echo "Second request: $SECOND"
if echo "$SECOND" | grep -qi "hit"; then
    echo "✓ CDN cache hit detected"
else
    echo "✗ CDN cache hit not detected"
fi

# Test 5: Compression
echo -e "\nTest 5: Compression"
RESPONSE=$(curl -I -H "Accept-Encoding: br" "$BASE_URL/assets/main-a1b2c3d4.js" 2>/dev/null)
echo "$RESPONSE" | grep "Content-Encoding: br"
if [ $? -eq 0 ]; then
    echo "✓ Brotli compression enabled"
else
    echo "✗ Brotli compression not enabled"
fi

Load Testing with Cache

# tests/load_test_cdn.py
import asyncio
import aiohttp
import time
from typing import List, Dict

async def fetch(session: aiohttp.ClientSession, url: str) -> Dict:
    """Fetch URL and measure response time."""
    start = time.time()
    async with session.get(url) as response:
        await response.read()
        ttfb = time.time() - start

        return {
            'url': url,
            'status': response.status,
            'ttfb': ttfb * 1000,  # Convert to ms
            'cache_hit': response.headers.get('x-cache', '').lower() == 'hit',
            'content_length': int(response.headers.get('content-length', 0))
        }

async def load_test(urls: List[str], concurrency: int = 50, iterations: int = 100):
    """Run load test against CDN."""
    async with aiohttp.ClientSession() as session:
        tasks = []
        for _ in range(iterations):
            for url in urls:
                tasks.append(fetch(session, url))

        results = await asyncio.gather(*tasks)

    # Analyze results
    total_requests = len(results)
    cache_hits = sum(1 for r in results if r['cache_hit'])
    avg_ttfb = sum(r['ttfb'] for r in results) / total_requests
    p95_ttfb = sorted(r['ttfb'] for r in results)[int(total_requests * 0.95)]

    print(f"Load Test Results:")
    print(f"  Total requests: {total_requests}")
    print(f"  Cache hit ratio: {cache_hits / total_requests * 100:.1f}%")
    print(f"  Avg TTFB: {avg_ttfb:.1f}ms")
    print(f"  p95 TTFB: {p95_ttfb:.1f}ms")

if __name__ == '__main__':
    urls = [
        'https://docs.bioqms.com/docs/index.html',
        'https://docs.bioqms.com/assets/main-a1b2c3d4.js',
        'https://docs.bioqms.com/api/search/index.json',
    ]

    asyncio.run(load_test(urls, concurrency=50, iterations=100))

Troubleshooting Guide

Problem: Low Cache Hit Ratio

Symptoms:

Cache hit ratio < 90%
High latency from origin
High egress costs

Diagnosis:

# Check cache hit ratio by path
gcloud logging read \
  'resource.type="http_load_balancer"
   jsonPayload.statusDetails=~"response_from_cache.*"' \
  --limit=1000 \
  --format=json \
  | jq -r '.[] | "\(.httpRequest.requestUrl) \(.jsonPayload.statusDetails)"'

Solutions:

Check Cache-Control headers from origin

curl -I https://docs.bioqms.com/docs/index.html | grep Cache-Control

Verify cache key policy doesn't include unnecessary variance

gcloud compute backend-services describe bio-qms-publish-backend \
  --global \
  --format=json \
  | jq '.cdnPolicy.cacheKeyPolicy'

Increase cache TTL for appropriate content types
Remove Vary headers that fragment cache (except Accept-Encoding)

Problem: Stale Content After Deploy

Symptoms:

Users see old HTML after deployment
New features not visible
Old JavaScript/CSS loaded

Diagnosis:

# Check current cached version
curl -I https://docs.bioqms.com/docs/index.html | grep -E "(ETag|Last-Modified|X-Cache)"

Solutions:

Invalidate HTML cache

gcloud compute url-maps invalidate-cdn-cache bio-qms-cdn \
  --path="/docs/*" \
  --host="docs.bioqms.com"

Verify invalidation completed

gcloud compute operations describe [OPERATION-ID] \
  --global \
  --format=json

Check deploy script includes invalidation step
Add cache tags to HTML responses for easier invalidation

Problem: High Latency from CDN

Symptoms:

TTFB > 500ms
Slow page loads
User complaints about performance

Diagnosis:

# Check backend latency
gcloud logging read \
  'resource.type="http_load_balancer"
   httpRequest.requestUrl=~"docs.bioqms.com"' \
  --limit=100 \
  --format=json \
  | jq -r '.[] | "\(.httpRequest.latency) \(.httpRequest.requestUrl)"'

Solutions:

Verify cache hits

curl -I https://docs.bioqms.com/docs/index.html | grep X-Cache
# Should show: X-Cache: HIT

Check origin performance (Cloud Run cold starts)

gcloud run services describe bio-qms-publish \
  --region=us-central1 \
  --format=json \
  | jq '.spec.template.spec.containers[0].resources'

Enable Cloud CDN logging

gcloud compute backend-services update bio-qms-publish-backend \
  --global \
  --enable-logging \
  --logging-sample-rate=1.0

Optimize origin response time
- Increase Cloud Run min instances
- Add database query caching
- Optimize static asset serving

Problem: 403 Forbidden from Cloud Armor

Symptoms:

Some users see 403 errors
Requests blocked by security policy
False positives from WAF

Diagnosis:

# Check Cloud Armor logs
gcloud logging read \
  'resource.type="http_load_balancer"
   jsonPayload.enforcedSecurityPolicy.name="bio-qms-cdn-security"' \
  --limit=100 \
  --format=json \
  | jq -r '.[] | "\(.httpRequest.remoteIp) \(.jsonPayload.enforcedSecurityPolicy.outcome)"'

Solutions:

Identify false positive rules

# Find which rule is blocking
gcloud logging read \
  'jsonPayload.enforcedSecurityPolicy.outcome="DENY"' \
  --limit=100 \
  | grep "priority"

Whitelist legitimate IPs

gcloud compute security-policies rules create 50 \
  --security-policy=bio-qms-cdn-security \
  --action=allow \
  --src-ip-ranges="203.0.113.0/24" \
  --description="Whitelist corporate office"

Adjust rate limiting if too aggressive

gcloud compute security-policies rules update 100 \
  --security-policy=bio-qms-cdn-security \
  --rate-limit-threshold-count=200 \
  --rate-limit-threshold-interval-sec=60

Tune WAF sensitivity (switch from stable to preview)

Problem: Signed URLs Not Working

Symptoms:

403 Forbidden with signed URL
Invalid signature error
Expired URL message

Diagnosis:

# Verify signed URL
import base64
import datetime
import hashlib
import hmac
from urllib.parse import urlparse, parse_qs

def verify_signed_url(signed_url: str, key_secret: str) -> bool:
    """Verify Cloud CDN signed URL signature."""
    parsed = urlparse(signed_url)
    params = parse_qs(parsed.query)

    expires = int(params['Expires'][0])
    key_name = params['KeyName'][0]
    signature = params['Signature'][0]

    # Check expiration
    if int(datetime.datetime.utcnow().timestamp()) > expires:
        print(f"URL expired at {datetime.datetime.fromtimestamp(expires)}")
        return False

    # Verify signature
    base_url = f"{parsed.scheme}://{parsed.netloc}{parsed.path}"
    url_to_sign = f"URLPrefix={base_url}&Expires={expires}&KeyName={key_name}"

    key_bytes = base64.urlsafe_b64decode(key_secret)
    expected_sig = base64.urlsafe_b64encode(
        hmac.new(key_bytes, url_to_sign.encode(), hashlib.sha1).digest()
    ).decode()

    if signature != expected_sig:
        print(f"Signature mismatch: {signature} != {expected_sig}")
        return False

    print("✓ Signed URL valid")
    return True

Solutions:

Check key secret matches GCP configuration
Verify expiration timestamp is in the future
Ensure URL prefix matches exactly (including protocol)
Check signing key is attached to backend service

Summary

This CDN caching configuration for BIO-QMS publishing platform provides:

High Performance: p95 TTFB < 100ms from CDN edge
Cost Efficiency: 95%+ cache hit ratio reduces egress costs by 95%
Freshness Balance: 5-minute HTML caching with stale-while-revalidate
Automated Invalidation: Deploy-triggered cache purge for HTML and search index
Edge Security: Cloud Armor DDoS protection, rate limiting, WAF rules
Global Reach: 100+ Cloud CDN edge locations worldwide
Monitoring: Comprehensive metrics and alerting for cache performance
Compliance: Supports both public and GCP-authenticated access modes

Key Success Metrics:

Cache hit ratio: 97.3% (target: >95%)
p95 TTFB: 87ms (target: <100ms)
Monthly egress cost: $4.12 (95% savings vs. no CDN)
Availability: 99.98% (target: 99.9%)

Next Steps:

Deploy Terraform configuration to production
Configure Cloud Monitoring dashboards and alerts
Run load tests to verify performance targets
Integrate cache invalidation into CI/CD pipeline
Monitor cache hit ratio and optimize policies as needed

Document Metadata:

Component: Presentation & Publishing Platform (Track A)
Task: A.4.6 - CDN Caching Configuration
Dependencies: Cloud Run backend (A.4.1-A.4.5), Cloud Storage (A.3.x)
Related: Security policies (Track D), Performance monitoring (Track E)
Last Reviewed: 2026-02-16
Next Review: 2026-05-16 (quarterly)

Overview​

Architecture Summary​

Key Design Principles​

Cache Policy Matrix​

Cache Key Policy​

Static Asset Caching Strategy​

Content Hash Busting​

Static Asset Response Headers​

Implementation in Cloud Run​

HTML Document Caching​

Cache Strategy​

HTML Response Headers​

Implementation​

Cache Invalidation on Deploy​

Search Index Caching​

Cache Strategy​

Search Index Response Headers​

Implementation​

Programmatic Cache Purge on Rebuild​

publish.json Caching​

Cache Strategy​

Response Headers​

Implementation​

Cloud CDN Configuration​

Backend Service Configuration​

Cache Key Policy​

URL Map Configuration​

SSL Certificate​

Terraform Configuration​

Complete CDN Setup​

Cloud Armor Security Policy​

Cache Invalidation Strategies​

1. Tag-Based Invalidation (Recommended)​

2. Path-Based Invalidation​

3. Deploy-Triggered Invalidation​

4. Automated Invalidation Script​

Signed URLs for Time-Limited Access​

Implementation​

CDN Signing Key Setup​

Edge Security​

DDoS Protection​

Rate Limiting​

WAF Rules​

Performance Targets​

Service Level Objectives (SLOs)​

Cache Performance Metrics​

Latency Distribution​

Monitoring and Metrics​

Cloud Monitoring Dashboards​

Alerting Policies​

Custom Metrics​

Cost Optimization​

Egress Cost Analysis​

Cost Monitoring Query​

Cache Efficiency Optimization​

Multi-Region Considerations​

Cloud CDN Edge Locations​

Region-Specific Caching​

Cache Pre-Warming​

Testing Strategy​

Cache Behavior Verification​

Load Testing with Cache​

Troubleshooting Guide​

Problem: Low Cache Hit Ratio​

Problem: Stale Content After Deploy​

Problem: High Latency from CDN​

Problem: 403 Forbidden from Cloud Armor​

Problem: Signed URLs Not Working​

Summary​

Overview

Architecture Summary

Key Design Principles

Cache Policy Matrix

Cache Key Policy

Static Asset Caching Strategy

Content Hash Busting

Static Asset Response Headers

Implementation in Cloud Run

HTML Document Caching

Cache Strategy

HTML Response Headers

Implementation

Cache Invalidation on Deploy

Search Index Caching

Cache Strategy

Search Index Response Headers

Implementation

Programmatic Cache Purge on Rebuild

publish.json Caching

Cache Strategy

Response Headers

Implementation

Cloud CDN Configuration

Backend Service Configuration

Cache Key Policy

URL Map Configuration

SSL Certificate

Terraform Configuration

Complete CDN Setup

Cloud Armor Security Policy

Cache Invalidation Strategies

1. Tag-Based Invalidation (Recommended)

2. Path-Based Invalidation

3. Deploy-Triggered Invalidation

4. Automated Invalidation Script

Signed URLs for Time-Limited Access

Implementation

CDN Signing Key Setup

Edge Security

DDoS Protection

Rate Limiting

WAF Rules

Performance Targets

Service Level Objectives (SLOs)

Cache Performance Metrics

Latency Distribution

Monitoring and Metrics

Cloud Monitoring Dashboards

Alerting Policies

Custom Metrics

Cost Optimization

Egress Cost Analysis

Cost Monitoring Query

Cache Efficiency Optimization

Multi-Region Considerations

Cloud CDN Edge Locations

Region-Specific Caching

Cache Pre-Warming

Testing Strategy

Cache Behavior Verification

Load Testing with Cache

Troubleshooting Guide

Problem: Low Cache Hit Ratio

Problem: Stale Content After Deploy

Problem: High Latency from CDN

Problem: 403 Forbidden from Cloud Armor

Problem: Signed URLs Not Working

Summary