AWS CloudFront and ELB: Is there a way to force connection using only CloudFront?

Question

I have an ELB which balances some EC2 instances. The ELB exposes the endpoints of the entire system.

Now I am creating a CloudFront distribution over this ELB. Is there a way to allow users to connect ONLY using CloudFront endpoint and refuse direct connections to ELB?

Thanks

Answer 1

You would have to restrict the security group to the list of IP address ranges used by CloudFront. This is a subset of the list published here.

Unfortunately that list is subject to change, so you can't just set it once and forget it. Amazon has published a tutorial here that walks you through setting up a Lambda function that will automatically update your security group when Amazon publishes an updated IP list.