A Network Engineer is designing a new system on AWS that will take advantage of Amazon CloudFront for both content caching and for protecting the underlying origin. There is concern that an external…

Question

Options

• AUse an IP whitelist rule in AWS WAF within CloudFront to ensure that only known-client IPs are
• BConfigure CloudFront to use a custom header and configure an AWS WAF rule on the origin's
• CConfigure an AWS Lambda@Edge function to validate that the traffic to the Application Load
• DAttach an origin access identity to the CloudFront origin that allows traffic to the origin that

• A
  5% (2)
• B
  62% (23)
• C
  14% (5)
• D
  19% (7)

Explanation

https://aws.amazon.com/vi/about-aws/whats-new/2016/01/amazon-cloudfront-adds-new-origin- security-features/ Add or modify request headers forwarded from CloudFront to your origin (launched Dec 28th): Now you can configure CloudFront to add custom headers or override the value of existing request headers when CloudFront forwards requests to your origin. You can use these headers to help validate that requests made to your origin were sent from CloudFront (shared secret) and configure your origin to only allow requests that contain the custom header values that you specify. This feature also helps with setting up Cross-Origin Request Sharing (CORS) for your CloudFront distribution - you can configure CloudFront to always add custom headers to your origin to accommodate viewers that don't automatically include those headers in requests. It also allows you to disable varying on the Origin header, which improves your cache hit ratio, yet forward the appropriate headers so that your origin can respond with the CORS header.

No community discussion yet for this question.