Allow only CloudFront to read from origin servers?

Question

I'm using origin servers on CloudFront (as opposed to s3) with signed URLs. I need a way to ensure that requests to my server are coming only from CloudFront. That is, a way to prevent somebody from bypassing CloudFront and requesting a resource directly on my server. How can this be done?

Answer 1

AWS have finally created an AWS managed prefix list for CloudFront to Origin server requests. So no more need for custom Lambdas updating Security Groups etc.

Use the prefix com.amazonaws.global.cloudfront.origin-facing in your Security Groups etc.

See the following links for more info:

• The What's New Announcement
• The Documentation