Question

A media company runs a web application behind an internal (private) Application Load Balancer inside a VPC. They want to serve this application globally through Amazon CloudFront for caching and TLS termination at the edge, but the security team mandates that the ALB must NOT be publicly accessible from the internet — traffic must only reach the ALB from CloudFront. Which design meets these requirements with the least operational overhead?

Accepted Answer

Use a CloudFront VPC origin that points directly to the internal ALB, so CloudFront reaches the private ALB over the AWS network without exposing it publicly.

Answer

Convert the ALB to internet-facing and restrict its security group to the published CloudFront IP ranges managed via an AWS-managed prefix list.

Answer

Place a public Network Load Balancer in front of the internal ALB and configure CloudFront to use the NLB as the origin, restricting the NLB with security groups.

Answer

Set up an AWS Site-to-Site VPN between the CloudFront edge locations and the VPC so the private ALB can be reached without a public endpoint.