How do I restrict direct traffic to an Application Load Balancer and only allow traffic through CloudFront?

Short description

To restrict direct traffic to an Application Load Balancer and only allow access through CloudFront, use Application Load Balancer listener rules. If you have an existing AWS WAF web access control list (ACL), then you can use web ACL rules. To further restrict access to your Application Load Balancer, configure your security group to restrict access to your origin. To do this, use the AWS managed prefix list. It's a best practice to use one of these solutions and also configure your security group.

Resolution

Application Load Balancer listener rules

To use Application Load Balancer listener rules to restrict traffic, see Restrict access to Application Load Balancers.

AWS WAF

Note: AWS WAF charges are based on the following factors:

• Amount of web ACLs that you create
• Number of rules that you add for each web ACL
• Amount of web requests that you receive

For more information, see AWS WAF pricing.

To use AWS WAF custom web ACL rules to restrict traffic, configure CloudFront to add a custom HTTP header. Then, create a rule in the AWS WAF web ACL that's associated with the Application Load Balancer. Use this rule to block requests that don't contain the custom HTTP header secret value.

Configure CloudFront to add a custom HTTP header

Complete the following steps:

1. Open the CloudFront console.
2. In the navigation pane, choose Distributions, and then select your distribution ID.
3. Choose the Origins tab.
4. Select your Application Load Balancer, and then choose Edit.
   Note: If your Application Load Balancer isn't an origin, update your distribution, and then set the Application Load Balancer as an origin.
5. For Add custom header, enter the Header name and Value.
   Important: The Header name and Value act as secure credentials, such as a username and password. Note the values for use later in this procedure.
6. Choose Save changes.

Create a rule in your web ACL to block requests without the header

Complete the following steps:

1. Open the AWS WAF console.
2. In the navigation pane, choose Resources & protection packs.
3. Choose Create protection pack.
4. Under Tell us about your app, for App category, select one or more app categories.
5. For Traffic source, choose the type of traffic the application engages with, such as API, Web, or Both API and Web.
6. Under Resources to protect, choose Add resources.
7. Under Global, choose Add Cloud front or Amplify resources.
8. Select your distribution from the list.
9. Under Choose protection pack, select Build your own pack from all of the protections AWS WAF offers.
10. In the right pane, choose Custom rule and select Next.
    Choose Custom rule again and selectNext.
11. Set the Rule Action to BLOCK.
12. Enter your Rule name.
13. For If a request, expand the dropdown and choose does not match the statement (NOT).
14. For Inspect, choose Single header.
15. Under Statement, complete the following:
    For Header field name, enter the Header name that you created in CloudFront.
    For Match type, choose Exactly matches string.
    For String to match, enter the Value that you created in CloudFront.
    (Optional) For Text transformation, choose None.
16. Choose Create rule.
17. (Optional) To set multiple rule priority, select Edit Rule Order in the right pane and then set this rule to the highest priority.
18. Choose Save Rule Order.
19. Under Name and description, enter a name for your protection pack.
20. Click Create protection pack.

Configure security groups

To further restrict traffic to an Application Load Balancer, use an AWS managed prefix list on security groups in the Application Load Balancer.

To update an existing security group, see Update the associated security groups. To associate your Application Load Balancer with a security group, complete the following steps:

1. Open the Amazon Elastic Compute Cloud (Amazon EC2) console.
2. In the navigation pane, under Load Balancing, choose Load Balancers.
3. Select your Application Load Balancer, and then choose Security.
4. Select the security group that you want to associate with your Application Load Balancer.
5. To modify the inbound rules, choose Edit inbound rules, and then update the configurations for your use case.
   Note: If you have a rule that allows 0.0.0.0/0, then you must add a new rule before you delete the existing rule.
6. To allow specific protocols, select the protocol, and then choose Custom.
7. For Source type, choose CloudFront, and then select your prefixes from the AWS managed prefix list.
8. Choose Save.
   Note: It's a best practice to allow ports that only your Application Load Balancer uses.

You can only add the CloudFront managed prefix list one time for each security group under the default settings because of the prefix list weight. To add another rule with CloudFront as the Source type in the same security group, request a quota increase. Or, use two security groups that both reference the CloudFront managed prefix list.

Related information

Limit access to your origins using the AWS managed prefix list for Amazon CloudFront

How can I restrict location access to web content that my CloudFront distribution serves?