Access ElasticBeanstalk only via CloudFront

Question

My current setup consists of CloudFront and Elastic Beanstalk. How to configure the security group of corresponding LoadBalancer so only requests from CloudFront can pass the LoadBalancer?

Does this answer your question? [AWS Cloudfront and ELB Security Groups](https://stackoverflow.com/questions/22188381/aws-cloudfront-and-elb-security-groups) — rpadovani, Feb 09 '22 at 09:38

score 1 · Answer 1 · answered Dec 30 '17 at 19:05

This can be done by setting up a Security Group with the Cloud Front IP Addresses, and restricting the EC2 instance to that security group. Since Cloudfront IP's change all the time, this will be updated with a Lambda Function.

Full Directions Are Here, but here are the cliff notes:

AWS Console -> EC2 -> Security Groups
Create A Security Group in the same VPC as your EB Instance, being sure to create the following tags:
- AutoUpdate: true
- Name: cloudfront
- Protocol: http (or alternatively this can be https, or something custom if you modify the script).
Create an IAM policy with the following contents:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:::" }, { "Effect": "Allow", "Action": [ "ec2:DescribeSecurityGroups", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "" } ] }

In IAM create a role utilizing the above policy
Create a Lambda Function based on this source code, and assigning it the role created in step #5.
Use the sample at the bottom of the source code to test the function.
When it fails because the JSON you pull does not match the hash in the test request, grab the hash value its expecting from the error message and replace the md5 value in the test sample with that value.
Rerun the test. This time it will succeed.

NOTE: Take a look at the groups you created and they're now populated with a whole bunch of entries for CloudFront IP's.

AWS Console -> Elastic Beanstalk -> Application -> Environment -> Configuration -> Instance - Update the groups to include the group-id of the group you created.

The Lambda Function will keep your IP list in sync.

score 0 · Answer 2 · edited May 23 '17 at 11:45

0

You can put an IAM Role on the Elastic BeanStalk to only allow incoming messages from CloudFront. OR you can only allow access to the ELB Instance from a certain port, then filter CloudFront to that port. For instance, Port 443 is HTTPS, grant CloudFront access to ELB via Port 443, then on your Security-Group, only allow Inbound Access to the instance from the IP that CloudFront will access it.

Check this out

edited May 23 '17 at 11:45

Community

1
1

answered Feb 29 '16 at 01:03

iSkore

7,394
3
34
59

3

Do you have an example of the IAM role for this use case? – user1791139 Feb 29 '16 at 07:08

score 0 · Answer 3 · answered Mar 01 '16 at 05:22

You can create a security group that only allows CloudFront and have it automatically updated. You can also add a custom header (preshared secret) between your distribution and your Elastic Beanstalk environment.

Access ElasticBeanstalk only via CloudFront

3 Answers3