A company plans to deploy an application that uses an Amazon CloudFront distribution. The company will set an Application Load Balancer (ALB) as the origin for the distribution. The company wants to…

Question

Options

• AConfigure the network ACLs in the subnet where the ALB is deployed to allow inbound traf-fic
• BCreate a VPC origin for the CloudFront distribution. Set the VPC origin Amazon Resource Name
• CCreate a security group that allows only inbound traffic from the public IP addresses of the
• DCreate a VPC origin for the CloudFront distribution. Configure an ALB rule. Set the source IP

• A
  5% (1)
• B
  27% (6)
• C
  59% (13)
• D
  9% (2)

Explanation

To ensure ALB access only via CloudFront, AWS prescribes restricting the origin to traffic from CloudFront. For ALB origins, the standard pattern is to allow inbound to the ALB only from CloudFront edge IP ranges using security groups or ALB listener rules. Network ACLs are coarse and stateless and add operational burden. CloudFront does not have a "VPC origin" object; instead, CloudFront references the ALB DNS name. By limiting the ALB's security group to CloudFront IP ranges, direct client access to the ALB is blocked while CloudFront remains permitted. This aligns with security best practices to "restrict origin access to only CloudFront" and use SGs for instance/ALB layer controls.

No community discussion yet for this question.