How do I use CloudFront VPC origins to secure my applications in a private subnet?
I want to use virtual private cloud (VPC) origins to host my Amazon CloudFront applications in a private subnet to restrict access for more security.
Resolution
Use Application Load Balancers, Network Load Balancers, and Amazon Elastic Compute Cloud (Amazon EC2) instances in private subnets as VPC origins.
VPC prerequisites
Before you create a VPC origin for your CloudFront distribution, complete the following requirements:
- Use Amazon Virtual Private Cloud (Amazon VPC) to create a VPC in the same AWS account as your CloudFront distribution and in a supported AWS Region for VPC origins.
- Include an inbound and outbound rule in your network access control list (network ACL) configuration.
- Make sure that your VPC has an internet gateway.
- Your VPC must include at least one available IPv4 address in your private subnet.
Note: You can use a private IPv4 address with no additional cost. VPC origins doesn't support IPv6 addresses. - Update your security groups to explicitly allow the CloudFront managed prefix list.
- You have access to the AWSServiceRoleForCloudFrontVPCOrigin service-linked role.
For more information, see Prerequisites.
Create a VPC origin
Use the CloudFront console to create a VPC origin. You can also use the CreateVpcOrigin and CreateDistribution API actions.
For more information, see Introducing Amazon CloudFront VPC origins: Enhanced security and streamlined operations for your applications.
- Language
- English
CloudFront VPC origins securely expose internal Application Load Balancers (ALBs), Network Load Balancers (NLBs), or Amazon EC2 instances deployed in private subnets, while preventing direct internet access. CloudFront connects to private origins through an AWS-managed VPC origin connection, which creates managed ENI inside the customer VPC and forwards standard HTTP(S) traffic directly to the origin’s private IP addresses. Origin access is enforced using VPC security groups,
This AWS blog explains how CloudFront VPC origins keep application backends private and shield them from the public internet.
You can further harden this architecture by
- Restrict origin access using SGs - explicitly allow inbound traffic only from the CloudFront managed prefix list.
- Enforce strong transport security - mtls
- Apply edge security controls - AWS WAF and AWS Shield to CloudFront.
- Validate and authorize requests - Custom origin headers, signed URLs, or signed cookies
Together, these controls create a non-internet-facing, non-bypassable, defense-in-depth ingress architecture
replied 8 months ago
Relevant content
asked 4 years ago
asked 5 years ago
