AWS AmazonCloudFront documentation change
Summary
Added documentation for Network Load Balancer as an origin and expanded guidance on using VPC origins to restrict public internet access
Security assessment
The changes emphasize using VPC origins to prevent applications from being exposed to the public internet, which is a security best practice. However, there is no evidence of addressing a specific security vulnerability or incident.
Diff
diff --git a/AmazonCloudFront/latest/DeveloperGuide/DownloadDistS3AndCustomOrigins.md b/AmazonCloudFront/latest/DeveloperGuide/DownloadDistS3AndCustomOrigins.md index 908c677b9..e3a77eedf 100644 --- a//AmazonCloudFront/latest/DeveloperGuide/DownloadDistS3AndCustomOrigins.md +++ b//AmazonCloudFront/latest/DeveloperGuide/DownloadDistS3AndCustomOrigins.md @@ -5 +5 @@ -Use an Amazon S3 bucketUse a MediaStore container or a MediaPackage channelUse an Application Load BalancerUse a Lambda function URLUse Amazon EC2 (or another custom origin)Use CloudFront origin groupsUse Amazon API Gateway +Use an Amazon S3 bucketUse a MediaStore container or a MediaPackage channelUse an Application Load BalancerUse a Network Load BalancerUse a Lambda function URLUse Amazon EC2 (or another custom origin)Use CloudFront origin groupsUse Amazon API Gateway @@ -11 +11 @@ When you create a distribution, you specify the _origin_ where CloudFront sends -If you have an Application Load Balancer, Network Load Balancer, or EC2 instance in a private subnet, you can use it as a VPC origin. VPC origins prevent your application from being accessible on the public internet. For more information, see [Restrict access with VPC origins](./private-content-vpc-origins.html). +If you have an Application Load Balancer, Network Load Balancer, or EC2 instance in a private subnet, you can use it as a VPC origin. With VPC origins, your applications can be accessed only in a private subnet with a CloudFront distribution, which prevents your application from being accessible on the public internet. For more information, see [Restrict access with VPC origins](./private-content-vpc-origins.html). @@ -24,0 +25,2 @@ You can use edge functions to dynamically select the appropriate origin for each + * Use a Network Load Balancer + @@ -469 +471,7 @@ For more information and step-by-step instructions, see the following topics: -To prevent your application from being accessible on the public internet, you can use your Application Load Balancer with a VPC origin. For more information, see [Restrict access with VPC origins](./private-content-vpc-origins.html). +You can use CloudFront to route traffic to both internal and internet-facing Application Load Balancers. + +If your origin is one or more HTTP(S) servers (web servers) hosted on one or more Amazon EC2 instances, you can choose to use an internet-facing Application Load Balancer to distribute traffic to the instances. An internet-facing load balancer has a publicly resolvable DNS name and routes requests from clients to targets over the internet. + +For more information about using an internet-facing Application Load Balancer as your origin for CloudFront, including how to make sure that viewers can only access your web servers through CloudFront and not by accessing the load balancer directly, see [Restrict access to Application Load Balancers](./restrict-access-to-load-balancer.html). + +Alternatively, you can use VPC origins to deliver content from applications that are hosted with an internal Application Load Balancer in your virtual private cloud (VPC) private subnets. VPC origins prevents your application from being accessible on the public internet. For more information, see [Restrict access with VPC origins](./private-content-vpc-origins.html). @@ -471 +479 @@ To prevent your application from being accessible on the public internet, you ca -Alternatively, if your origin is one or more HTTP(S) servers (web servers) hosted on one or more Amazon EC2 instances, you can choose to use an internet-facing Application Load Balancer to distribute traffic to the instances. An internet-facing load balancer has a publicly resolvable DNS name and routes requests from clients to targets over the internet. +## Use a Network Load Balancer @@ -473 +481,3 @@ Alternatively, if your origin is one or more HTTP(S) servers (web servers) hoste -For more information about using an Application Load Balancer as your origin for CloudFront, including how to make sure that viewers can only access your web servers through CloudFront and not by accessing the load balancer directly, see [Restrict access to Application Load Balancers](./restrict-access-to-load-balancer.html). +You can use both internal and internet-facing Network Load Balancers with Amazon CloudFront. You can use internal Network Load Balancers inside private subnets with CloudFront by using VPC origins. CloudFront VPC origins allow you to serve content from applications hosted in private VPC subnets without exposing them to the public internet. For more information, see [Restrict access with VPC origins](./private-content-vpc-origins.html). + +Alternatively, you can also use CloudFront for delivering traffic from internet-facing Network Load Balancers. An internet-facing load balancer has a publicly resolvable DNS name and can receive requests from both clients on the internet and CloudFront distributions. @@ -521,0 +532,2 @@ For more information about Lambda function URLs, see the following topics in the +You can use both internal and internet-facing EC2 instances with Amazon CloudFront. You can use internal EC2 instances inside private subnets with CloudFront by using VPC origins. CloudFront VPC origins allow you to serve content from applications hosted in private VPC subnets without exposing them to the public internet. For more information, see [Restrict access with VPC origins](./private-content-vpc-origins.html). + @@ -528,2 +539,0 @@ Most CloudFront features are supported when you use a custom origin with the exc -To prevent your application from being accessible on the public internet, you can use your EC2 instance with a VPC origin. For more information, see [Restrict access with VPC origins](./private-content-vpc-origins.html). -