Lecture 165: Hands On: CloudFront Origin Groups
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:18
- 来源：Udemy Lecture 28556135
- Slide 数量：21
- 画面切换：00:12、00:33、00:52、01:09、01:26、01:46、02:03、02:25、02:43、03:04、03:23、03:39、03:54、04:10、04:30、04:44、05:07、05:24、05:45、06:06
扫描说明
逐条读取了 Udemy 页面中的 146 条英文 Transcript cue，并按时间轴扫描全长约 06:19 的视频。按约每 7 条 cue 截取 22 个控制台候选画面，联系表确认页面边界完整且无侧栏、控件、弹窗、黑边或裁切；最后两张均为同一 index2.html 成功响应，移除末尾重复帧后保留 21 个有效步骤。所有成品图均从 video 元素计算真实 16:9 媒体区域，并输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Origin Group 实验准备
时间范围：00:00–00:12
总结 / Summary
中文
实验将创建 S3 Bucket 作为主源站（Primary Origin），并准备另一个源站用于故障转移（Failover）。
English
The exercise will use an S3 bucket as the primary origin and prepare another origin for failover.
Transcript
00:00 Okay, so let's practice
00:01 origin groups in CloudFront
00:03 So the first thing I'm going to do
00:04 is to create an S3 buckets,
00:06 and on that S3 bucket I'm going to upload
00:08 a simple index.html file.
00:11 So let me create a bucket,
2. 创建 S3 Bucket
时间范围：00:12–00:33
总结 / Summary
中文
在 eu-central-1 创建 demo-origin-groups S3 Bucket；为简化演示暂时关闭阻止所有公开访问（Block Public Access）。
English
A demo-origin-groups S3 bucket is created in eu-central-1. Block Public Access is disabled temporarily to simplify the demonstration.
Transcript
00:12 I'll call this one demo-origin-groups,
00:16 and then we can create in the eu-central-1 region,
00:19 this is fine.
00:20 And then we are not going to,
00:22 we can unlock Block all access to public.
00:25 just to make things very, very, very simple.
00:28 We are going to just create this buckets.
3. 上传 index.html
时间范围：00:33–00:52
总结 / Summary
中文
向 S3 Bucket 上传简单的 index.html，内容用于明确识别响应来自 S3 Primary Origin。
English
A simple index.html file is uploaded to the S3 bucket so responses from the S3 primary origin are easy to identify.
Transcript
00:33 My bucket is now created,
00:34 so I'm going to go in it and I'm going to upload a file.
00:37 I will add a file and this file is going to be
00:40 my cloudFront folder under index.html.
00:44 So this is a file that is very simple, it should just say,
00:48 Hello this is index.html from S3.
00:50 So super simple file.
4. 公开 S3 Object 并准备 EC2
时间范围：00:52–01:09
总结 / Summary
中文
将演示对象设为公开访问，然后开始创建 EC2 Instance 作为 Secondary Origin。生产环境应改用源站访问控制（OAC）保护私有 Bucket。
English
The demo object is made public, and an EC2 instance is prepared as the secondary origin. Production designs should instead protect a private bucket with OAC.
Transcript
00:52 Now we're going to make this file public, very quickly,
00:55 so I'm going to do Action and then Make public,
01:00 and this is to make sure that this file
01:01 will be publicly accessible.
01:03 So this is good.
01:04 Next, we're going to go into our EC2 instances
01:07 and we're going to create a new instance, okay.
5. 启动 Amazon Linux EC2
时间范围：01:09–01:26
总结 / Summary
中文
在同一 Region 启动 Amazon Linux 2 EC2 Instance，并通过 User Data 安装简单 Web Server。
English
An Amazon Linux 2 EC2 instance is launched in the same Region and configured with a simple web server through user data.
Transcript
01:09 In the same region we're in, in eu-central-1,
01:12 and it's going to be an Amazon Linux 2,
01:14 and we're just going to install a very simple web server.
01:17 So at the very bottom, I have the user data
01:19 that I get from before.
01:21 Now, this web server has a little bit of a distinction.
01:24 So as we can see here, we have two files, we're creating,
6. User Data 创建两个页面
时间范围：01:26–01:46
总结 / Summary
中文
User Data 安装并启动 httpd，同时创建 index.html 与 index2.html；后者只存在于 EC2，用于验证 S3 失败后的 Origin Failover。
English
The user data installs and starts httpd and creates both index.html and index2.html. The second file exists only on EC2 to test failover after an S3 miss.
Transcript
01:26 we're creating index.html and index2.html.
01:31 And the idea behind this is that we want
01:33 this EC2 instance to be the fail-over of our S3 buckets
01:37 in terms of origin group.
01:39 So this is why we have a second index2.html
01:41 as you'll see in the hands-on it will be very helpful.
01:43 So we're going to Add Storage, Add Tags,
7. 允许 SSH 与 HTTP
时间范围：01:46–02:03
总结 / Summary
中文
EC2 安全组（Security Group）允许 SSH 和 HTTP，然后启动 Instance；至此 Primary S3 与 Secondary EC2 均已准备。
English
The EC2 security group permits SSH and HTTP, and the instance is launched. Both the primary S3 and secondary EC2 resources are now ready.
Transcript
01:46 configure security group,
01:47 and just make sure that you have SSH and HTTP access
01:51 from anywhere and then Review and Launch,
01:55 Launch and yes,
01:57 Launch my instance.
01:59 So now we're good.
02:00 We have an EC2 instance and an extra bucket ready.
8. 创建 CloudFront Distribution
时间范围：02:03–02:25
总结 / Summary
中文
进入 CloudFront 创建 Distribution，初始 Origin Domain 选择 demo-origin-groups S3 Bucket。
English
A CloudFront distribution is created with the demo-origin-groups S3 bucket as its initial origin domain.
Transcript
02:03 So what I'm going to do is go into the CloudFront service
02:05 and create a distribution that will have these origin group.
02:09 So let's go ahead and create this CloudFront distribution.
02:12 So my origin domain is going to be
02:14 demo-origin-groups.amazons3, Okay,
02:19 And then for a path, this is optional,
02:22 but we'll leave it as is, the name is fine.
9. 演示配置与 OAI 最佳实践
时间范围：02:25–02:43
总结 / Summary
中文
因为演示对象已公开，暂不使用源站访问身份（Origin Access Identity, OAI）；讲师强调生产环境应使用 OAI/OAC 限制 Bucket 仅供 CloudFront 访问。
English
Because the demo object is public, OAI is skipped. The instructor emphasizes using OAI or OAC in production to restrict the bucket to CloudFront.
Transcript
02:25 Sorry, the name is fine.
02:26 We can use an OAI if you wanted to restrict
02:30 the bucket access only to cloudFronts,
02:32 but because we made the extra bucket public
02:34 and we made the file in our S3 bucket public,
02:37 we can just right now not using OAI,
02:39 but the best practice is definitely to use an OAI, okay,
10. 使用 Default Cache Behavior
时间范围：02:43–03:04
总结 / Summary
中文
其余缓存行为（Cache Behavior）保持默认并创建 Distribution，随后等待全局部署。
English
The remaining cache behavior settings stay at their defaults, the distribution is created, and global deployment begins.
Transcript
02:43 then we will scroll down and then we'll look
02:46 at the behavior is fine.
02:49 Everything should be left as default.
02:51 So let's keep it, everything as defaults.
02:53 And then at the very bottom, I will create my distribution.
02:57 So my distribution is now creating and in the meantime,
03:01 let's just test a little bit, a few things.
11. 验证 EC2 index.html 与 index2.html
时间范围：03:04–03:23
总结 / Summary
中文
通过 EC2 Public IP 直接测试两个页面，确认 index.html 和 index2.html 都由 Secondary EC2 Origin 正常提供。
English
Both index.html and index2.html are tested directly through the EC2 public IP, confirming that the secondary EC2 origin serves them correctly.
Transcript
03:04 So if we go into our public IP
03:07 for our EC2 instance,
03:11 we get the index.html, which is fine,
03:13 which is the same as doing /index.html.
03:16 And then if we do index2.html,
03:19 we get a second file, this is index2.html page.
03:22 So now let's wait
12. Distribution 部署完成
时间范围：03:23–03:39
总结 / Summary
中文
Distribution 状态变为 Deployed 后，复制 CloudFront Domain Name，并使用 /index.html 测试 S3 Origin。
English
After the distribution reaches Deployed status, its CloudFront domain name is copied and /index.html is tested against the S3 origin.
Transcript
03:23 for the cloudFront distribution to be created.
03:24 And then once it's deployed,
03:26 then we'll get back to this.
03:28 So my cloudFront distribution is now ready.
03:30 I can copy the distribution domain name,
03:33 and then open a new tab and make sure you do /index.html
03:37 to access the index.html file.
13. S3 /index.html 成功
时间范围：03:39–03:54
总结 / Summary
中文
请求 /index.html 成功返回 Hello from S3；若省略文件路径，则因未配置 Default Root Object 而出现 AccessDenied。
English
A request to /index.html returns the S3 page successfully. Omitting the file path causes AccessDenied because no default root object is configured.
Transcript
03:39 If you don't do /index.html,
03:41 you're going to get an Access Denied error.
03:43 So once you do /index.html,
03:45 you get the file back from S3.
03:47 So, Hello, this is index.html from S3.
03:48 That means that things are working.
03:51 And if you do /index2.html,
14. S3 /index2.html AccessDenied
时间范围：03:54–04:10
总结 / Summary
中文
S3 Bucket 中没有 index2.html，因此当前 Distribution 返回 AccessDenied；这个错误将作为 Failover 触发条件。
English
Because index2.html does not exist in the S3 bucket, the current distribution returns AccessDenied. This error will be used to trigger failover.
Transcript
03:54 you're going to get an Access Denied message,
03:55 because that file does not exist on our S3 buckets.
03:59 So now let's go ahead and set up a cloudFront origin group
04:02 to solve that problem.
04:03 Okay, so let's go ahead and create an origin,
04:06 so we're going to create our second origin
04:08 by clicking on Create origin,
15. 创建 EC2 Custom Origin
时间范围：04:10–04:30
总结 / Summary
中文
新增 Custom HTTP Origin，必须填写 EC2 Public IPv4 DNS 而不是 IP Address；CloudFront 自动识别为 HTTP Endpoint。
English
A custom HTTP origin is added using the EC2 public IPv4 DNS, not its IP address. CloudFront recognizes it as an HTTP endpoint.
Transcript
04:10 and then we need to enter a domain.
04:12 So you go to your EC2 instance
04:14 and what you have to take is the Public iPv4 DNS.
04:18 So please take the DNS and not the IP address,
04:21 otherwise this will not work.
04:23 So take the DNS, you enter the domain here
04:26 and then automatically it is recognized as HTTP.
16. 保存 Secondary EC2 Origin
时间范围：04:30–04:44
总结 / Summary
中文
保留自动生成的 Origin Name 并创建 EC2 Origin，然后进入 Origin Group 配置。
English
The generated origin name is retained, the EC2 origin is created, and configuration proceeds to the origin group.
Transcript
04:30 And then for the Name, we'll just leave it as is.
04:33 click on Create origin.
04:35 And here we go,
04:36 our second origin is created,
04:38 and now we're going to group them together
04:40 into an origin group.
04:42 So the origins we want to add to the group
17. S3 Primary + EC2 Secondary
时间范围：04:44–05:07
总结 / Summary
中文
在源站组（Origin Group）中把 S3 放在第一顺位作为 Primary Origin，把 EC2 放在第二顺位作为 Secondary Origin，并命名为 DemoOriginGroup。
English
The origin group places S3 first as the primary origin and EC2 second as the secondary origin, under the name DemoOriginGroup.
Transcript
04:44 is obviously going to be the S3 buckets,
04:47 and then we'll add the EC2 instance as the secondary origin.
04:50 So the primary one is our S3 buckets,
04:52 the secondary one is our EC2 instance.
04:55 So I will call it DemoOriginGroup,
04:58 and then we need to specify a fail-over criteria, okay,
05:03 So fail-over criteria, we'll select also any kind of errors
18. 配置 Failover Criteria
时间范围：05:07–05:24
总结 / Summary
中文
选择需要触发故障转移（Failover）的 HTTP Error Status Code，使 S3 返回相关错误时 CloudFront 自动尝试 EC2。
English
HTTP error status codes are selected as failover criteria so CloudFront automatically tries EC2 when S3 returns those errors.
Transcript
05:07 that comes back from the S3 buckets
05:08 should be fell over into my EC2 instance, okay.
05:12 So this is good. Let's create this origin group.
05:17 So now we're good to go.
05:18 And next, in terms of the Behaviors
05:21 of our cloudFront distribution,
05:22 we need to edit this one.
19. Behavior 指向 Origin Group
时间范围：05:24–05:45
总结 / Summary
中文
编辑默认缓存行为（Default Cache Behavior），把 Origin Target 从单个 S3 Origin 改为 DemoOriginGroup，并保存等待部署。
English
The default cache behavior is edited so its origin target changes from the individual S3 origin to DemoOriginGroup, then the update is deployed.
Transcript
05:24 So we'll edit this behavior,
05:26 and instead of deploying to this origin right now,
05:29 we're going to deploy to distribute to the origin group.
05:34 Now we'll click on Save changes
05:37 and we'll have to wait until this is deployed.
05:39 So let's just wait for the deployment to be over.
05:42 Okay, so my distribution is now updated
20. Primary 正常时仍返回 S3
时间范围：05:45–06:06
总结 / Summary
中文
更新完成后，/index.html 在 Primary S3 中存在，因此直接返回 S3 页面，不会访问 Secondary Origin。
English
After the update, /index.html still comes directly from the primary S3 origin because the object exists there.
Transcript
05:45 and let's have a look at it, so if we go back to this URL,
05:48 if we go to index.html, as we can see, we get a,
05:51 Hello, this is indexed.html from S3,
05:54 but now if you go to index2.html,
05:57 as you can see, we get, this is,
05:59 Hello, this is index2.html page from the EC2 instance.
06:04 So it tried first to go to the S3 buckets,
21. 缺失对象自动 Failover 到 EC2
时间范围：06:06–06:18
总结 / Summary
中文
请求 /index2.html 时，Primary S3 返回错误，CloudFront 依据 Failover Criteria 对 Secondary EC2 重试并成功返回 EC2 页面，完整验证 Origin Group。
English
For /index2.html, the primary S3 origin returns an error, so CloudFront retries the secondary EC2 origin according to the failover criteria and successfully returns the EC2 page.
Transcript
06:06 get an error message,
06:07 and then forward things to the origin group
06:09 requested the exact same file from the EC2 instance
06:12 and it works.
06:13 So that's it for this demo, it was pretty cool, right?
06:15 I hope you liked it, and I will see you in the next lecture.
整讲总结 / Overall Summary
中文
本讲用 S3 Primary Origin 与 EC2 Secondary Origin 实作 CloudFront 源站组（Origin Group）。先创建公开 S3 Bucket 并上传 index.html，再启动安装 httpd 的 EC2 Instance，提供 index.html 与 index2.html。创建 CloudFront Distribution 后，/index.html 从 S3 成功返回，而 /index2.html 因 S3 中不存在对象而返回 AccessDenied。随后使用 EC2 Public IPv4 DNS 创建 Custom HTTP Origin，把 S3 设为 Primary、EC2 设为 Secondary，并把相关 HTTP 错误状态码配置为故障转移条件（Failover Criteria）。最后把默认缓存行为（Default Cache Behavior）的目标改为 Origin Group。更新部署后，/index.html 仍来自 S3；/index2.html 先在 S3 失败，再由 CloudFront 自动对 EC2 重试并成功返回，验证 Origin Failover。
English
This lecture builds a CloudFront origin group with an S3 primary origin and an EC2 secondary origin. It first creates a public S3 bucket containing index.html, then launches an EC2 instance running httpd with both index.html and index2.html. After creating the CloudFront distribution, /index.html succeeds from S3 while /index2.html returns AccessDenied because that object is absent. The EC2 public IPv4 DNS is then added as a custom HTTP origin. S3 becomes the primary origin, EC2 the secondary, and selected HTTP errors become failover criteria. Finally, the default cache behavior is changed to target the origin group. After deployment, /index.html still comes from S3, while /index2.html fails at S3 and CloudFront automatically retries EC2 successfully, demonstrating origin failover.
返回顶部 ↑