Overview
CloudFront can reach any custom HTTP backend, including an EC2 instance or an Application Load Balancer. Users access CloudFront edge locations, and the edge locations make requests to your backend. See ALB for the load balancer itself.
With a public-origin setup, edge locations reach the origin over the public network, so the origin (EC2 or ALB) must be public. CloudFront VPC origins (see below) are the private alternative.
The course said CloudFront has no private VPC connectivity. Since 2024-11, CloudFront VPC origins can reach ALB, NLB and EC2 in private subnets. The public-origin pattern still works but is no longer the only option. AWS source
Pattern 1: EC2 Instance as Origin
- For a public origin, the EC2 instances must be public, otherwise edge locations cannot reach them.
- The EC2 security group must allow the public IPs of all CloudFront edge locations. The list of CloudFront IPs is published by AWS at a URL referenced in the lecture.
Pattern 2: ALB as Origin
- For a public origin, the ALB must be public.
- The backend EC2 instances can be private, because there is a private VPC connection between the ALB and the EC2 instances.
- The EC2 security group must allow the security group of the load balancer.
- The ALB security group must allow the public IPs of the CloudFront edge locations.
| Pattern | Public component | EC2 security group allows | Load balancer security group allows |
|---|---|---|---|
| EC2 origin | EC2 instance | CloudFront edge public IPs | - |
| ALB origin | ALB (EC2 can be private) | The ALB's security group | CloudFront edge public IPs |
Public-origin pattern: EC2 origin -> EC2 must be public. ALB origin -> only the ALB must be public, EC2 can stay private. In both cases, allow the CloudFront edge IPs in the public component's security group.
ALB as a CloudFront origin
CloudFront VPC Origins
CloudFront VPC origins let CloudFront reach an ALB, NLB or EC2 instance in a private subnet. The origin is reachable only via CloudFront. The VPC needs an Internet Gateway (IGW).
- The public-origin pattern above still works.
- It is no longer the only option: with VPC origins the ALB or EC2 does not have to be public.
CloudFront VPC origins (2024-11) replace the old rule that the origin must be public. AWS source
Questions & Answers
Q1: Can EC2 instances behind CloudFront be private?
Answer:
Yes, with CloudFront VPC origins. In the public-origin pattern, a direct EC2 origin must be public and its security group must allow the CloudFront edge IPs. With an ALB origin, the ALB is public and the EC2 instances can be private.
Q2: What must the security group of EC2 instances behind an ALB origin allow?
Answer:
The security group of the load balancer. The ALB's own security group allows the CloudFront edge public IPs.
Check yourself
Quiz
Flashcards
Click the card (or focus it), then use ← → to move and Space to flip.