0

Setup is: cloudfront -> load balancer -> ec2 server

CloudFront logs shows the request are coming from these IP's and User Agent.

c-ip = 52.2.212.237 44.207.101.129

cs(User-Agent) = Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36

Jesse P
  • 1

1 Answers1

0

Those are both AWS EC2 IP addresses: ec2-52-2-212-237.compute-1.amazonaws.com and ec2-44-207-101-129.compute-1.amazonaws.com, respectively (per https://whois.domaintools.com).

CloudFront caches your server's content for 24 hours by default. After that time, the next request for each resource will reach your server, and whatever your server returns will be cached for the next 24 hours. That means, assuming there's a fairly constant stream of requests from the internet to your site, you'll see a spike once per day, and those requests will appear to your server to have come from CloudFront or the load balancer (depending on what type of load balancer, I believe).

JacquesOfAllTrades
  • 1