Lightsail Firewall Limit - Cloudfront

Question

I am trying to add all the Cloudfront IPs using CIDR but I am hitting the limit. Shouldnt there be an easier way to tell lightsail firewall that it should only allow Cloudfront traffic? there is a json, why as a customer do I need to add this myself to start with? Also it seems illogical that the ip list is larger than the limit of the Lighstail firewall?

MikeLim · Accepted Answer

For EC2, there is [managed prefix list for CloudFront](https://aws.amazon.com/blogs/networking-and-content-delivery/limit-access-to-your-origins-using-the-aws-managed-prefix-list-for-amazon-cloudfront/).

You can retrieve CloudFront prefixes with the following command

`curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | jq -r '.prefixes[] | select (.service=="CLOUDFRONT_ORIGIN_FACING") | .ip_prefix' | sort -V`

There are about 48 IP prefixes.

I assume you are using Amazon CloudFront and not Lightsail CDN. If the former, you can have CloudFront send a custom header, and configure your web server (Apache or Nginx) to validate this header. Refer to [Origin cloaking](https://aws.amazon.com/developer/application-security-performance/articles/origin-cloaking/) on how to configure you web service.

re:Post Agent · Answer

You're correct that there are some challenges when trying to add all CloudFront IPs to a Lightsail firewall, and your frustration is understandable. Let me clarify a few points and provide some context:

1. Lightsail firewall limits: Each Lightsail instance has two firewalls - one for IPv4 and one for IPv6. The limit for adding source IP addresses is 30 at a time using the console, or up to 60 using the API, AWS CLI, or SDK. This limit applies separately to IPv4 and IPv6 rules.

2. CloudFront IP ranges: CloudFront uses a large number of IP addresses, which can indeed exceed the Lightsail firewall rule limits. This is why you're encountering difficulties adding all the CloudFront IPs.

3. Consolidating IP ranges: To work around this limitation, it's recommended to consolidate individual IP addresses into CIDR ranges where possible. This can help reduce the number of rules needed.

4. No built-in CloudFront option: Unfortunately, there isn't a simple built-in option in Lightsail to allow only CloudFront traffic. This is why you need to add the IP ranges manually.

5. AWS service integration: You're right that it would be more convenient if there was an easier way to allow CloudFront traffic directly. This kind of integration between AWS services isn't always available, especially for simpler, more streamlined services like Lightsail.

To address your situation, you might consider the following approaches:

1. Use the API, CLI, or SDK to add up to 60 rules instead of 30.
2. Carefully consolidate the CloudFront IP ranges into broader CIDR blocks where possible.
3. If you still can't accommodate all CloudFront IPs, prioritize the most commonly used ones for your region.
4. Consider if a more advanced service like Amazon EC2 with security groups might better suit your needs if you require more complex firewall configurations.

While it may seem illogical that the IP list is larger than the firewall limit, this reflects the balance Lightsail strikes between simplicity and advanced features. For more complex networking needs, other AWS services might be more appropriate.  
**Sources**  
[Control instance traffic with firewalls in Lightsail - Amazon Lightsail](https://docs.aws.amazon.com/lightsail/latest/userguide/understanding-firewall-and-port-mappings-in-amazon-lightsail.html)  
[Add firewall rules to Lightsail instances - Amazon Lightsail](https://docs.aws.amazon.com/lightsail/latest/userguide/amazon-lightsail-editing-firewall-rules.html)  
[Manage firewall ports for Lightsail for Research virtual computers - Amazon Lightsail for Research](https://docs.aws.amazon.com/lightsail-for-research/latest/ug/manage-ports.html)

Lightsail Firewall Limit - Cloudfront

Relevant content