Cloudfront with private EC2 origin

Question

I want to integrate cloudfront with private origin as all the instances will be in private subnet with outpost setup.

while creating cloudfront distribution I tried adding private DNS of EC2 (ip-XX-XX-XX-XX.us-east-2.compute.internal) but its giving error : 502 bad gateway

I have below questions :

1. Can we have aws cloudfront with private origin (EC2 instance) ?
2. Can we use cloudfront as a shared proxy cache inside private subnet ?

Answer 1

Update 2024: Introducing CloudFront Virtual Private Cloud (VPC) Origins: Shield your web applications from public internet | Networking & Content Delivery

---

Amazon CloudFront lives on the Internet. When it retrieves content from an Origin, the content must be accessible from the Internet.

Amazon EC2 instances in a private subnet are not accessible from the Internet. Therefore, CloudFront would not be capable of accessing the content.

Private IP addresses can only be resolved and used within the VPC. They are not accessible from outside the VPC.

Answer 2

A good practice for this would be to use IP prefix list - available as part of VPC functionality. There you would find managed Cloudfront IP Prefix list, you can reference it in your Security group ingress/egress rules. Updates of this list are managed by AWS.

Additionally, if you are using any other CDN’s, such as Cloudflare, you can populate your own prefix lists and manage in similar fashion your SG rules. Mind that custom prefix lists you have to manage yourself - something I employ myself Lambdas for.