SAP-C02 · Question #597
A company recently migrated a web application from an on-premises data center to the AWS Cloud. The web application infrastructure consists of an Amazon CloudFront distribution that routes to an…
The correct answer is B. Update ALB security group ingress to allow access only from the. The company needs to restrict access to an Application Load Balancer so that it is only accessible via an Amazon CloudFront distribution, requiring the least effort.
Question
A company recently migrated a web application from an on-premises data center to the AWS Cloud. The web application infrastructure consists of an Amazon CloudFront distribution that routes to an Application Load Balancer (ALB), with Amazon Elastic Container Service (Amazon ECS) to process requests. A recent security audit revealed that the web application is accessible by using both CloudFront and ALB endpoints. However, the company requires that the web application must be accessible only by using the CloudFront endpoint. Which solution will meet this requirement with the LEAST amount of effort?
Options
- ACreate a new security group and attach it to the CloudFront distribution. Update the ALB security
- BUpdate ALB security group ingress to allow access only from the
- CCreate a com.amazonaws.region.elasticloadbalancing VPC interface endpoint for Elastic Load
- DExtract CloudFront IPs from the AWS provided ip-ranges.json document. Update ALB security
How the community answered
(41 responses)- A7% (3)
- B85% (35)
- C5% (2)
- D2% (1)
Why each option
The company needs to restrict access to an Application Load Balancer so that it is only accessible via an Amazon CloudFront distribution, requiring the least effort.
You cannot attach a security group directly to an Amazon CloudFront distribution, as CloudFront operates outside of a VPC and its security model differs from EC2 resources.
The most straightforward and least effort approach is to configure the Application Load Balancer's (ALB) security group ingress rules to only allow traffic from the known AWS CloudFront IP address ranges, which are conveniently available via a CloudFront managed prefix list.
Creating a VPC interface endpoint for Elastic Load Balancing is for private access to the ALB's management plane, not for controlling public ingress traffic to the ALB itself from CloudFront.
Manually extracting CloudFront IPs from ip-ranges.json and then using a Lambda function to update the ALB's security group is a high-effort, complex, and less reliable solution compared to using the managed CloudFront prefix list directly in the security group.
Concept tested: CloudFront security, ALB security groups, network access control
Source: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/restrict-access-to-load-balancer.html
Community Discussion
No community discussion yet for this question.