How to secure EC2 access via cloudfront only

[premiumrush]

I read that at this point of time, it is impossible to restrict an EC2 instance access to Cloudfront only.

What other ways can I use to secure my origin web server? I dont want the public to bypass Cloudfront and let the web server be accessed directly.

 

[davidktw]

I read that at this point of time, it is impossible to restrict an EC2 instance access to Cloudfront only.

What other ways can I use to secure my origin web server? I dont want the public to bypass Cloudfront and let the web server be accessed directly.

https://aws.amazon.com/blogs/securi...n-cloudfront-and-aws-waf-by-using-aws-lambda/

 

[premiumrush]

https://aws.amazon.com/blogs/securi...n-cloudfront-and-aws-waf-by-using-aws-lambda/

Yea, i read that article. Wonder why AWS Cloudfront didn't just use static IPs for their endpoints like Cloudflare.

 

[davidktw]

Yea, i read that article. Wonder why AWS Cloudfront didn't just use static IPs for their endpoints like Cloudflare.

If cloudfront uses static endpoints, how is it going to scale? Cloudflare did not give you a static list too. The list is dynamic, just that it seldom change.