A new web app runs on ECS Fargate behind an ALB in us-east-1. Route 53 hosts the domain. Content is mostly static (images/files) and seldom updated. Most users are in the United States, with some traffic from Canada and Europe. The design must lower latency for users at minimal cost, and all traffic must be encrypted in transit until it reaches the ALB. Which design meets these needs?

The correct option leverages Amazon CloudFront, a global content delivery network (CDN), to cache static content closer to users worldwide, significantly lowering latency and reducing origin server load. Configuring CloudFront with an SSL certificate and redirecting HTTP to HTTPS ensures all traffic is encrypted in transit and meets the security requirement. An alias record in Route 53 pointing to the CloudFront distribution seamlessly integrates the CDN with the custom domain. The first incorrect option uses AWS Global Accelerator, which optimizes network paths but doesn't cache content, making it less effective for static content delivery and latency reduction compared to a CDN. The second incorrect option correctly uses CloudFront but incorrectly routes the Route 53 alias record directly to the ALB instead of the CloudFront distribution, bypassing the CDN. The fourth incorrect option adds a second application stack in another region and uses Global Accelerator with latency-based routing, which is an over-engineered and more expensive solution for primarily static content, and still lacks caching benefits.