Lecture 164: CloudFront Origins
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:57
- 来源：Udemy Lecture 28556133
- Slide 数量：23
- 画面切换：00:21、00:42、01:00、01:20、01:37、02:00、02:15、02:34、02:54、03:12、03:30、03:50、04:07、04:23、04:39、05:02、05:21、05:37、05:52、06:08、06:26、06:45
扫描说明
逐条读取了 Udemy 页面中的 181 条英文 Transcript cue，并按时间轴扫描全长约 06:58 的视频。按每 8 条 cue 截取 23 个候选画面；联系表确认每个画面都对应新的 Origin 类型、网络路径、访问控制、路径路由或故障转移动画，没有纯重复帧，因此全部保留。截图均关闭 Transcript 侧栏并隐藏播放器控件，按 video 元素的真实 16:9 媒体区域截取；成品无弹窗、无黑边、无右侧或下方裁切，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. S3 Origin 与 OAC
时间范围：00:00–00:21
总结 / Summary
中文
S3 Bucket 可作为 CloudFront 源站（Origin）分发或接收文件；源站访问控制（Origin Access Control, OAC）用于保护对私有 Bucket 的访问。
English
An S3 bucket can serve as a CloudFront origin for file distribution or uploads, while Origin Access Control secures access to the private bucket.
Transcript
00:00 So what are the origins of CloudFront?
00:02 Well, we have an S3 bucket,
00:03 and this is used for distributing files from S3 to the web
00:07 or back from the web to S3
00:09 to upload them using CloudFront as an ingress,
00:12 and the security is maintained and guaranteed
00:15 through the use of
00:16 the CloudFront Origin Access Controller OAC feature.
2. Media Services 与 VPC Origin
时间范围：00:21–00:42
总结 / Summary
中文
MediaStore Container 和 MediaPackage Endpoint 可承载视频点播（VOD）或 Live Streaming；VPC Origin 则把私有子网（Private Subnet）中的应用作为源站。
English
MediaStore containers and MediaPackage endpoints support video on demand and live streaming, while VPC origins expose applications hosted in private subnets.
Transcript
00:21 You can also use CloudFront as a media store container
00:23 and media package endpoint.
00:25 This is used to deliver video on demand, VOD
00:27 or live streaming videos using AWS media services.
00:32 You also have VPC Origin
00:33 for application hosted in VPC private subnets,
00:36 and this is to distribute content hosted
00:39 through an application balancer, a network balancer,
3. Private ALB、NLB 与 EC2 Origins
时间范围：00:42–01:00
总结 / Summary
中文
VPC Origin 可以把私有应用负载均衡器（ALB）、网络负载均衡器（NLB）或弹性计算云实例（EC2 Instance）直接连接到 CloudFront。
English
A VPC origin can connect CloudFront directly to a private ALB, NLB, or EC2 instance.
Transcript
00:42 or directly on EC2 instances,
00:44 but all of that in private networks.
00:46 You can also use a custom origin, which is HTTP based.
00:50 So this is for anything that's public,
00:52 so you could use it on top of an API gateway
00:54 if you wanted more control
00:55 otherwise, you can use straight from API Gateway,
00:58 the API gateway Edge feature,
4. Custom HTTP Origins
时间范围：01:00–01:20
总结 / Summary
中文
自定义源站（Custom Origin）必须是公开 HTTP Endpoint，例如 API Gateway、启用静态网站托管（Static Website Hosting）的 S3 Bucket，或 AWS 内外的 Public HTTP Backend。
English
A custom origin must be a public HTTP endpoint, such as API Gateway, an S3 static website, or another public HTTP backend inside or outside AWS.
Transcript
01:00 or you can use it for example, on an S3 bucket
01:03 that's configured as a website.
01:04 First, you need to enable static website hosting,
01:08 or finally any HTTP backend you want that is public
01:12 hosted in or outside of AWS.
01:16 Now, let's have a look at the CloudFront
01:17 as an origin for S3.
01:19 In this case,
5. S3 Origin 与 Global Edge Locations
时间范围：01:20–01:37
总结 / Summary
中文
S3 Bucket 位于 AWS Cloud 内，CloudFront 在 Los Angeles、São Paulo、Mumbai、Melbourne 等全球边缘站点（Edge Location）分发其内容。
English
The S3 bucket resides in AWS, while CloudFront distributes its content through global edge locations such as Los Angeles, São Paulo, Mumbai, and Melbourne.
Transcript
01:20 we have a S3 bucket that lives within our cloud,
01:23 and that's going to be our origin,
01:25 and we're going to set up CloudFront.
01:27 So the idea is that CloudFront will have
01:28 multiple edge locations around the world,
01:30 for example, in Los Angeles, Sao Paolo,
01:32 Mumbai, and Melbourne,
01:34 and we're going to set up CloudFront in a specific way
6. OAC + Bucket Policy
时间范围：01:37–02:00
总结 / Summary
中文
源站访问控制（OAC）与 S3 Bucket Policy 结合，只允许来自指定 CloudFront Distribution 的请求进入 Bucket，使 CloudFront 成为公开访问私有内容的唯一入口。
English
OAC combines with an S3 bucket policy to allow only requests from the designated CloudFront distribution, making CloudFront the sole public path to private content.
Transcript
01:37 that is going to be compatible with our S3 buckets.
01:39 We're going to use an origin access control, so OAC,
01:43 and we'll combine this with an S3 bucket policy,
01:46 and this will guarantee that the only request
01:48 that go into the S3 buckets are originating from CloudFront,
01:52 effectively making CloudFront the only way
01:53 to access publicly the content of your S3 buckets.
01:57 Now, whenever the users request data
7. Edge Miss 到 S3 Origin
时间范围：02:00–02:15
总结 / Summary
中文
Edge Cache Miss 时，请求通常先查询区域边缘缓存（Regional Edge Cache），随后才由该层向 S3 Origin 取回对象。
English
On an edge-cache miss, CloudFront normally checks the regional edge cache before that layer fetches the object from the S3 origin.
Transcript
02:00 from one of these edge locations,
02:01 they will go and ask it if their data exists.
02:03 If it doesn't exist,
02:05 then the edge location will first fetch
02:07 the regional Edge cache location,
02:09 and then the cache location will ask
02:11 the origin for the data,
02:13 which I've represented as a simple line.
8. AWS Private Network 分发
时间范围：02:15–02:34
总结 / Summary
中文
源站数据通过 AWS 私有网络（AWS Private Network）送往 Edge Location；图中省略了 Regional Edge Cache，但实际路径仍经过该层。
English
Origin data travels over the AWS private network toward edge locations. The diagram omits the regional edge cache, but the actual path still uses that layer.
Transcript
02:15 I just omitted the Regional Edge cache in this diagram,
02:18 but it goes directly from the origin into the Edge Location
02:20 using the private network of AWS.
02:23 So this is the case for
02:24 all the Edge locations around the world,
02:26 effectively making an easy way to distribute an S3 bucket
02:29 that is original endpoint
02:30 into a globally available website.
9. VPC Origin 访问 Private Subnets
时间范围：02:34–02:54
总结 / Summary
中文
VPC Origin 让 CloudFront 从私有子网（Private Subnet）直接读取 ALB、NLB 或 EC2 内容，无需把这些资源暴露到互联网。
English
A VPC origin lets CloudFront retrieve content directly from an ALB, NLB, or EC2 instance in private subnets without exposing those resources to the internet.
Transcript
02:34 So if you want to use the VPC origin functionality,
02:37 you can actually get content directly
02:39 from your private subnets into CloudFront
02:41 using what's called a private origin.
02:44 So that means that you can deliver traffic
02:46 to private applicational balancers,
02:48 network cloud balancers and EC2 instances.
02:51 So CloudFront will connect through something
10. VPC Origin 是首选安全方案
时间范围：02:54–03:12
总结 / Summary
中文
配置 VPC Origin 后，CloudFront 通过专用私有连接访问应用，安全性与架构完整性优于旧式 Public Origin。
English
After configuring a VPC origin, CloudFront uses dedicated private connectivity to the application, providing a more secure design than legacy public origins.
Transcript
02:54 called the VPC origin that we must set up,
02:56 and then we have optimal security
02:58 and an optimal setup for this.
03:00 So this is to me the best way of doing things,
03:03 but you may want to know how to do it also using public IPs
03:07 and public ARBs and as origins.
03:09 So this is what I'm gonna show you
03:10 is just the old way of doing things,
11. Legacy Public EC2 Origin
时间范围：03:12–03:30
总结 / Summary
中文
旧式 EC2、ALB 或 On-Premises HTTP Origin 必须可公开访问，因为 Edge Location 会通过公共网络向源站发起请求。
English
In the legacy model, EC2, ALB, or on-premises HTTP origins must be publicly reachable because edge locations contact them over public networking.
Transcript
03:12 but good to know from an exam perspective,
03:14 because the exam might be tricky.
03:17 You can also use CloudFront origins
03:19 with application balancers
03:21 or EC2 instances, for example, as origin
03:23 or even on-premises web server.
03:26 So the idea is that your EC2 instance
03:28 must be publicly accessible.
12. Edge Location 请求 Public EC2
时间范围：03:30–03:50
总结 / Summary
中文
用户先访问 Edge Location；首次未命中缓存时，Edge Location 直接向具有 Public Reachability 的 EC2 HTTP Endpoint 请求内容。
English
The user reaches an edge location first. On the initial cache miss, the edge location directly requests the content from the publicly reachable EC2 HTTP endpoint.
Transcript
03:30 Why?
03:31 Well, because the edge locations
03:33 are going to be accessing publicly your HTTP endpoints,
03:36 and so your EC2 instance will have a security group
03:39 and the user will go into the Edge Locations,
03:41 the Edge Location will not have the content cached at first,
03:44 and so the Edge Locations will ask the origin,
03:46 in this case, our EC2 instance to get the contents.
13. Security Group 允许 CloudFront IPs
时间范围：03:50–04:07
总结 / Summary
中文
EC2 安全组（Security Group）应只允许 CloudFront Edge Location 的 Public IP Range；AWS 发布的 IP 列表可用于维护该允许规则。
English
The EC2 security group should allow only CloudFront edge-location public IP ranges, which AWS publishes for use in allow rules.
Transcript
03:50 In which case, well, you must allow the public IP
03:52 of the Edge locations
03:54 into the security group of your EC2 instances,
03:57 otherwise things will not work.
03:58 And how do you find the CloudFront IPs?
04:00 Well, you just use this URL,
04:02 which gives you all the list of IPs
04:04 that can be coming into your EC2 instances,
14. Public ALB + Private EC2
时间范围：04:07–04:23
总结 / Summary
中文
Public ALB 可作为 CloudFront Origin，同时后端 EC2 Instance 保持在 Private Subnet；只有 ALB 需要被 Edge Location 公开访问。
English
A public ALB can serve as the CloudFront origin while its backend EC2 instances remain in private subnets; only the ALB must be publicly reachable from edge locations.
Transcript
04:07 and therefore, you have a secure security group.
04:10 Alternatively, if you want to use,
04:11 for example, an application balancer,
04:13 then again, it must be public
04:15 because the Edge locations will access the data,
04:17 the website publicly,
04:19 but your EC2 instances in the backend
04:21 can still remain private because
15. ALB Security Group Chain
时间范围：04:23–04:39
总结 / Summary
中文
ALB 安全组（Security Group）允许 CloudFront Public IP，EC2 安全组只允许 ALB Security Group；这形成从 Edge 到 ALB 再到 Private EC2 的最小权限链路。
English
The ALB security group permits CloudFront public IPs, while the EC2 security group permits only the ALB security group, creating a least-privilege chain from edge to ALB to private EC2.
Transcript
04:23 they are only accessed by the ALB.
04:26 So once this is it,
04:27 then the users will go into the edge locations,
04:29 again using all public IPs,
04:31 and then the applications will request the data
04:33 from your application balancer.
04:35 Therefore, you must allow
04:36 from the security group perspective of your ALB,
16. Multiple Origins 与 Path Patterns
时间范围：04:39–05:02
总结 / Summary
中文
单个 Distribution 可按内容路径选择不同源站（Origin），例如 /images/* 到 S3、/api/* 到 Custom HTTP Backend，而 /* 作为默认路径。
English
A single distribution can select different origins by content path, such as /images/* to S3, /api/* to a custom HTTP backend, and /* as the default.
Transcript
04:39 the public IP of the edge locations, okay?
04:43 CloudFront can also have multiple origins
04:45 based on the content type.
04:47 So the idea is that you can define different paths.
04:48 For example, if the users go to /images/*,
04:52 then go to an S3 bucket as an origin
04:55 or for /ap/*, then go to a custom HTTP backend
04:59 or /* for a default route.
17. Cache Behaviors 路由到 ALB
时间范围：05:02–05:21
总结 / Summary
中文
缓存行为（Cache Behavior）把 /api/* 匹配到 ALB HTTP Origin；每个 Behavior 既定义缓存策略，也绑定对应 Origin。
English
A cache behavior maps /api/* to an ALB HTTP origin. Each behavior defines caching rules and selects its associated origin.
Transcript
05:02 The idea is that CloudFront
05:03 will have different cache behaviors for different routes,
05:07 and these routes are going to go to different origins.
05:10 So in this example,
05:11 I'm saying that anything that starts with /api/*
05:14 is going to an HTTP origin,
05:16 which is an application balancer,
05:18 and anything that says /* overall
18. Default Behavior 路由到 S3
时间范围：05:21–05:37
总结 / Summary
中文
未匹配 /api/* 的请求落入默认 /* Behavior，并转发到 S3 Origin。路径优先级决定最终 Origin。
English
Requests that do not match /api/* fall through to the default /* behavior and are sent to the S3 origin. Path precedence determines the final origin.
Transcript
05:21 will go into an S3 bucket.
05:22 That means that the default route,
05:23 if it doesn't match the /api route,
05:25 will go into an S3 buckets.
05:27 You can also group origins together,
05:29 and this is to increase high availability and do failover.
05:32 So with an origin group,
05:34 you have one primary and one secondary origin,
19. Origin Group 高可用
时间范围：05:37–05:52
总结 / Summary
中文
源站组（Origin Group）由一个 Primary Origin 和一个 Secondary Origin 组成，用于提高可用性并提供自动故障转移（Failover）。
English
An origin group contains one primary and one secondary origin to improve availability and provide automatic failover.
Transcript
05:37 and the idea is that if the primary origin fails
05:39 for whatever reason,
05:40 maybe it's unavailable,
05:41 maybe it just doesn't respond correctly and so on,
05:43 then this second origin is going to be used.
05:46 So this gives you a backup.
05:47 So for example, I have an origin group
05:49 of two EC2 instances in this example,
20. Primary Error 触发 Secondary
时间范围：05:52–06:08
总结 / Summary
中文
若 Primary Origin 返回配置的错误状态码，CloudFront 会向 Secondary Origin 重试同一请求，并把成功响应返回客户端。
English
If the primary origin returns a configured error status, CloudFront retries the same request against the secondary origin and returns its successful response.
Transcript
05:52 platform will send a request,
05:53 but then it will respond with an error status code,
05:56 in which case, CloudFront will say, okay,
05:58 I'm going to try the same request on your second origin,
06:00 maybe it will work better.
06:02 And maybe the second origin will say,
06:03 yes, here is the response you're expecting
06:05 with the okay status code.
21. S3 Multi-Region Origin Group
时间范围：06:08–06:26
总结 / Summary
中文
Origin Group 也可使用两个不同 Region 的 S3 Bucket；Primary 与 Secondary Bucket 构成 CloudFront 的跨 Region 备份。
English
An origin group can use S3 buckets in two Regions, with primary and secondary buckets forming a cross-Region backup for CloudFront.
Transcript
06:08 You can also apply this with S3 buckets.
06:09 So this could be giving you a good multi-region setup
06:13 for CloudFront and Amazon S3.
06:15 So for example, we're going to get CloudFront
06:17 asking a primary origin as S3 buckets,
06:21 and then the second origin as a second S3 bucket.
06:24 But you're going to be smart
06:25 and you're going to set up a replication
22. S3 Replication 保持内容一致
时间范围：06:26–06:45
总结 / Summary
中文
配置 S3 跨 Region 复制（Cross-Region Replication）后，Secondary Origin 拥有与 Primary 相同的对象，Region 故障时可无缝接管。
English
With S3 Cross-Region Replication, the secondary origin contains the same objects as the primary and can take over during a Regional failure.
Transcript
06:26 between the S3 buckets,
06:28 meaning that the origin B, which is in another region
06:30 will have the exact same content as origin A.
06:34 Therefore, in case the first origin,
06:37 for example, one region is down,
06:39 then CloudFront will fail over back
06:41 to the origin B in another region
06:43 of the same S3 bucket content
23. Region-Level High Availability
时间范围：06:45–06:57
总结 / Summary
中文
CloudFront Origin Group 与复制的 S3 Bucket 组合，实现 Region-Level High Availability：主 Region 不可用时仍可从备用 Region 提供数据。
English
A CloudFront origin group combined with replicated S3 buckets provides Region-level high availability, serving data from the backup Region when the primary is unavailable.
Transcript
06:45 and will still get the data available.
06:48 So it's a really good way to do
06:49 a region level high availability for S3 and CloudFront.
06:53 So that's it for Origins.
06:54 I hope you liked it, and I will see you in the next lecture.
整讲总结 / Overall Summary
中文
CloudFront 源站（Origin）可以是 S3 Bucket、AWS Media Services Endpoint、VPC Origin 或公开 HTTP Custom Origin。S3 场景推荐使用源站访问控制（Origin Access Control, OAC）配合 Bucket Policy，只允许 CloudFront 读取私有对象。VPC Origin 允许 CloudFront 直接连接私有子网（Private Subnet）中的 ALB、NLB 或 EC2，是更安全的现代方案。旧式公共源站方案要求 EC2/ALB 可公开访问，并在安全组（Security Group）中只允许 CloudFront Edge Location 的公开 IP；ALB 后端 EC2 仍可保持私有。一个 Distribution 可按路径模式（Path Pattern）定义多个缓存行为（Cache Behavior），将 /api/、/images/ 和默认 /* 路由到不同 Origin。源站组（Origin Group）包含 Primary 和 Secondary Origin，在主源返回配置的错误状态码时自动故障转移（Failover）；配合跨 Region S3 Replication，可实现 Region-Level High Availability。
English
CloudFront origins can be S3 buckets, AWS Media Services endpoints, VPC origins, or public HTTP custom origins. For S3, Origin Access Control combined with a bucket policy restricts private-object access to CloudFront. A VPC origin lets CloudFront connect directly to ALBs, NLBs, or EC2 instances in private subnets and is the preferred secure design. The older public-origin pattern requires a publicly reachable EC2 instance or ALB and a security group that allows only CloudFront edge-location public IPs; EC2 instances behind the ALB can remain private. One distribution can define multiple cache behaviors by path pattern and route /api/, /images/, and the default /* to different origins. An origin group provides primary/secondary failover when the primary returns configured error codes. Combined with cross-Region S3 replication, it provides Region-level high availability.
返回顶部 ↑