How to Restrict EC2 Access to AWS CloudFront Distribution

Select Language:

If your Amazon EC2 instance is in a private subnet, you might wonder how to set it up as a source for CloudFront. If your communication involves an EC2 in a public subnet with a public IP, you could assign it directly as the origin for a CloudFront distribution in another account. However, for private subnet instances, the process is different, and a better method is to use a VPC origin.

Using a VPC origin allows you to set an EC2 instance in a privateSubnet as the CloudFront source. This setup ensures that only the CloudFront you specifically create can access the EC2 instance, providing an extra layer of security. To achieve this, you need to share your CloudFront distribution across accounts using AWS Resource Access Manager (RAM).

Sharing the VPC origin through RAM means that the EC2 instance in a different AWS account can be used safely and securely as the origin for your CloudFront distribution. This way, you control access strictly, preventing any other distributions from using the instance as an origin.

You can find more detailed instructions and follow the official guide at this link: AWS CloudFront VPC origins documentation.

Remember, sharing VPC origins with AWS RAM helps you manage cross-account access securely—making sure only authorized CloudFront distributions can use your private EC2 instances as sources.