How do I use CloudFront VPC origins to secure my applications in a private subnet?

Resolution

Use Application Load Balancers, Network Load Balancers, and Amazon Elastic Compute Cloud (Amazon EC2) instances in private subnets as VPC origins.

VPC prerequisites

Before you create a VPC origin for your CloudFront distribution, complete the following requirements:

• Use Amazon Virtual Private Cloud (Amazon VPC) to create a VPC in the same AWS account as your CloudFront distribution and in a supported AWS Region for VPC origins.
• Include an inbound and outbound rule in your network access control list (network ACL) configuration.
• Make sure that your VPC has an internet gateway.
• Your VPC must include at least one available IPv4 address in your private subnet.
  Note: You can use a private IPv4 address with no additional cost. VPC origins doesn't support IPv6 addresses.
• Update your security groups to explicitly allow the CloudFront managed prefix list.
• You have access to the AWSServiceRoleForCloudFrontVPCOrigin service-linked role.

For more information, see Prerequisites.

Create a VPC origin

Use the CloudFront console to create a VPC origin. You can also use the CreateVpcOrigin and CreateDistribution API actions.

For more information, see Introducing Amazon CloudFront VPC origins: Enhanced security and streamlined operations for your applications.