I have created a A Route53 recordset for AWS application load balancer DNS. My question is whether AWS Cloudfront origin can contain this recordset url or not?

For example: ALB DNS name: xxxx.us-east-1.elb.amazonaws.com. Recordset Entry in Route53 for application load balancer DNS: www.abc.com

Now can I put www.abc.com as origin in cloudfront ?

  • You can put anything as the origin in CloudFront, as long as it is accessible from the Internet... it doesn't even have to be an AWS resource... but perhaps a fair question here is "why?" Why not use the balancer name? What are you wanting to accomplish? – Michael - sqlbot Mar 16 '18 at 1:07
  • @Michael-sqlbot . The idea is to enable secure traffic from Cloudfront to load balancer. I plan to deploy the SSL certificate(www.abc.com) on the load balancer. I am thinking if I directly use load balancer name as origin, will the traffic from cloudfront to load balancer will be secure or not? Because traffic will be routed from Cloudfront to load balancer using load balancer name and certificate on load balancer is on different domain(www.abc.com). for exmaple: domain is www.abc.com and load balancer name is xxxx.us-east-1.elb.amazonaws.com – Dave Mar 16 '18 at 9:24

If you set the Origin Protocol to HTTPS Only, the traffic between CloudFront and the ELB will be secured by TLS, and you can configure the actual origin domain name either way. The Cloudfront-Forwarded-Proto header will indicate the protocol used between CloudFront and the viewer (since in this configuration, the load balancer will always set X-Forwarded-Proto: https).

CloudFront insists that the TLS negotiation between itself and the Origin be trustworthy. A factor commonly overlooked is that TLS (SSL) certificates do two things: provide for encryption of the connection (obvious) and provide for authentication of the server -- attestation that the server is authorized to be a server for the requested hostname, and is not an impostor (less obvious). This is why you get browser warnings if the server's certificate's subject and/or subject alternative name doesn't match the hostname in the browser's address bar.

CloudFront allows a limited exception to this requirement, allowing certificate validation to succeed as long as one of two conditions is met:

  • The ELB must present a certificate matching the Origin Domain Name, or
  • The ELB must present a certificate matching the Host header that CloudFront is forwarding from the browser to the ELB.

Otherwise, CloudFront returns 502 Bad Gateway.

The first condition isn't possible if you use the ELB hostname as the Origin Domain Name, which is why the CloudFront console prompts you to whitelist the Host header for forwarding if it sees that your target is an ELB.

But as long your environment looks like this...

  • www.example.com points to CloudFront and is configured in the distribution's Alternate Domain Name, and
  • The Host header is configured for whitelisting, and
  • The ELB hostname is set as the Origin Domain Name, and
  • The ELB has a valid cert for www.example.com

...then it works, with one exception: the dzczcexample.cloudfront.net domain can't be used in the browser to access your origin through CloudFront. In some configurations, this is desirable, because you don't actually want your content accessible via that second entry point.

Otherwise, your best bet is indeed to do what you have suggested -- mapping a hostname in a domain that you control onto the ELB in DNS, and configuring that hostname as the origin domain name in CloudFront.

CloudFront can use any Internet-accessible hostname as its origin -- the origin doesn't have to be inside AWS. You could, for a random example, use a Google Cloud Storage bucket as an Origin in CloudFront. The integration between CloudFront and the Origin is a loose one -- by that, I mean that CloudFront has no special awareness of ELB. It just resolves the hostname via public DNS and makes connections.

Note also, if you want to ensure that only your CloudFront distribution can talk to your origin, you will want to configure a secret Custom Origin Header in CloudFront, and the Origin needs to reject requests that lack this value. While it is possible to use the ELB security group to allow access only from the CloudFront address space, that space grows fairly often and you need a way to keep your security groups updated to allow new address ranges... but it is my opinion that this provides a false sense of security, since anyone can technically create a CloudFront distribution and point it anywhere, including your ELB. Using a custom header avoids this.

  • Thanks for detailed answer. I am a beginner to Cloudfront. Sorry I could not understand your explanation fully but looks like I got the answer that I can point domain name (pointing to load balancer via route 53) as origin – Dave Mar 16 '18 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.