The header value should be a long random string. Navigate to Cloudfront → → Origins → Edit, and configure the origin with a custom header. Now add the header secret to the CloudFront distribution. When combined with the Match viewer policy below, this will make sure the secret is always transmitted over HTTPS. Make sure Redirect HTTP to HTTPS is checked. Configure CloudFrontįirst, navigate to Cloudfront → → Behaviors → Default → Edit: This is necessary because CloudFront distributions are not associated with security groups, nor are fixed IPs available (unlike higher-priced competitors like Kona Site Shield). The solution is to add a secret header value at the edge, and configure the load balancer to block requests that are missing this secret. With a little extra work, access to the origin can be restricted. This is a great feature, however it's ineffective if origin servers can be attacked directly, bypassing CloudFront. Amazon has been steadily improving their CloudFront CDN offering with WAF (Web Application Firewall) capabilities.

Cloudfront waf