Amazon Web Services has announced the launch of Amazon CloudFront VPC origins, a new feature that enables content delivery from applications hosted in private subnets within their Amazon Virtual Private Cloud (Amazon VPC). This simplifies securing web applications, allowing you to focus on growing your business while improving security and maintaining high performance and global scalability with CloudFront.
Customers serving content from Amazon S3, AWS Elemental Services, and AWS Lambda Function URLs could use Origin Access Control as a managed solution to secure their origins and make CloudFront the single front door to your application. However, this was more difficult to achieve for applications hosted on Amazon EC2 or using load balancers because you had to create your own solution to achieve the same result. You would have to use a combination of methods such as using access control lists (ACLs), managing firewall rules, or using logic such as header validation and a few other techniques to ensure that the endpoint remained exclusive to CloudFront.
CloudFront VPC origins removes the need for this undifferentiated work by offering a managed solution that can be used to point CloudFront distributions directly to Application Load Balancers (ALBs), Network Load Balancers (NLBs), or EC2 instances inside your private subnets. This ensures that CloudFront becomes the sole ingress point for those resources with minimal configuration effort, providing improved performance and a cost-saving opportunity because it also eliminates the need for public IP addresses.
CloudFront VPC origins is available at no additional cost, making it an accessible option for all AWS customers. It can be integrated with new or existing CloudFront distributions using the Amazon CloudFront console or the AWS Command Line Interface (AWS CLI).
It's important to continue layering your application's security by using services such as AWS Web Application Firewall (WAF) to protect from web exploits, AWS Shield for managed DDoS protection, and other services to achieve full-spectrum protection.
