Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Is is possible to restrict access to an EC2 origin to a specific cloudfront distribution?

0

I'm learning about CloudFront. I've set up a distribution using the free flat-rate plan. I've created an origin pointing to my EC2 instance and created a security group allowing access from the CloudFront IPv6 prefix list. I can add a WAF rule to restrict access to the distribution to just my client IP range. All works fine, but what is to stop someone else creating a distribution which also points at my EC2 instance? It would come from the same CloudFront prefix list so would not be blocked by the security group.

Thanks

Topics
Security, Identity, & ComplianceNetworking & Content Delivery
Tags
Amazon CloudFrontSecurity GroupAWS WAF
Language
English

asked a month ago113 views

2 Answers
6
Accepted Answer

Since VPC Origins are not available on the Free Tier, the standard AWS workaround is to restrict access at the application layer using Custom HTTP Headers.

  1. In CloudFront: Add a custom header to your Origin settings (e.g., X-Shared-Secret: <your-random-string>).

  2. On your EC2 instance: Configure your web server (e.g., Nginx or Apache) to check for this specific header. Reject any requests (e.g., return a 403 Forbidden) that do not contain the correct header and value.

Crucial security note: You must configure CloudFront to use HTTPS for the connection to your origin. If you use HTTP, the custom header is transmitted in plain text over the internet and could be intercepted, completely defeating the security mechanism.

EXPERT

answered a month ago

EXPERT

reviewed a month ago

2

Hello.

Is your EC2 instance located in a private subnet?
If your EC2 instance is located in a public subnet and has a public IP address assigned, you can configure it as the origin from a CloudFront distribution located in a different account.

In cases like this, I recommend using a VPC origin.
In the case of a VPC origin, it is possible to set an EC2 instance located in a private subnet as the origin, so your EC2 instance cannot be set as the origin by anything other than the CloudFront you created.
To configure an EC2 instance located in a different AWS account as a VPC origin, you need to share CloudFront via RAM.
In other words, you cannot set your EC2 instance as the origin for any CloudFront distribution other than the one you have approved.
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-vpc-origins.html

CloudFront supports sharing VPC origins across AWS accounts, whether they're in your organization or not. You can share VPC origins from the CloudFront console or use AWS Resource Access Manager (AWS RAM). For more information, see Working with shared resources in CloudFront.

EXPERT

answered a month ago

EXPERT

reviewed a month ago

  • rde1
    a month ago

    The instance is in a IPv6 only subnet. I looked at using a VPC origin but these are not available in the CloudFront free plan.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content