Object storage holds files by key. A content delivery network caches those files near readers so the origin does less work. Wren Media stores an uploaded photo once and publishes several immutable image sizes. Its CDN can cache a public size for a year when the URL includes a content version. Replacing the bytes at the same long-lived URL creates a much harder invalidation problem.
Public and private content need different rules. A cache key that ignores authorization can serve one person's file to another person. Signed URLs need an expiry and a policy for revocation. You'll separate upload from delivery, calculate origin traffic, and use immutable object names so a new version can appear without waiting for every cache to expire.