Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

if i understood well, in order to create a custom origin distribution, I need to make public those files on my custom origin server.

In my case, that will be put those files into a public dir of an apache server. My question is, is it possible to restrict access to that apache server to just cloudfront?

I know how to do it to allow only one ip, but, how to do it with cf?

Thanks in advance!

share|improve this question
Did you ever find an answer to this? I am in the same situation and I want to know how to do this as well. I am planning on using the CDN as a preventative measure against DDoS and if I can hide the server from the public, all the better. – karnage Aug 29 '11 at 21:22
@karnage - in case you are still interested, I've provided a late answer below. – Steffen Opel Jan 18 '12 at 13:13
Also consider that if someone visits the cloudfront URI, then there will be no access restriction. – Myster Mar 25 '13 at 0:18

You could restrict access to the published Amazon CloudFront Public IP Ranges; however, be aware of the respective disclaimer by Amazon:

The CloudFront IP addresses change frequently and we cannot guarantee advance notice of changes. On a best-effort basis, we will provide the list of current addresses. Customers should not use these addresses for mission critical applications and must never hard code them in DNS names. [emphasis mine]

Consequently you should monitor this forum/post to take notice of respective changes as early as possible (if this constraint is acceptable for your use case in the first place of course).

share|improve this answer
The published link is broken. – Shoan Sep 17 '14 at 4:57
@Shoan - fixed, thanks. – Steffen Opel Sep 17 '14 at 11:17
You might use this Lambda function that updates the ip's automatically::… This uses a pretty elegant way to fix the hardcoding of the ip's since the notication is sent out by Amazon itself, so we can assume it's always accurate. – Karel May 25 at 13:51

On origin web servers you can create a redirection rule so that all requests to the origin URL are redirected to the website URL (which points to CloudFront).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.