Search code examples
amazon-web-servicesamazon-s3amazon-cloudfrontamazon-vpc

Is it possible to secure Cloud front distribution to be accessed only within VPC or ECS?

I want to read an S3 through Cloud front. I have made S3 as private and I want to secure cloud front distribution url as well. Is it possible to make Cloud front accessible only with in VPC or ECS?

Thanks.

Solution

  • You can attach WAF(Web Applicaton Firewall) to secure the cloudfront distribution. You can utilise IP Match Condition in the WAF to allow the traffic only from a set of IPs

    If you want to allow or block web requests based on the IP addresses that the requests originate from, create one or more IP match conditions. An IP match condition lists up to 10,000 IP addresses or IP address ranges that your requests originate from. Later in the process, when you create a web ACL, you specify whether to allow or block requests from those IP addresses.