Lecture 167: CloudFront Origin Security
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：04:18
- 来源：Udemy Lecture 28556145
- Slide 数量：20
- 画面切换：00:12、00:28、00:41、00:52、01:05、01:17、01:33、01:47、02:01、02:13、02:27、02:38、02:50、03:01、03:12、03:26、03:38、03:52、04:07
扫描说明
逐条读取了 Udemy 页面中的 100 条英文 Transcript cue，并按时间轴扫描全长约 04:18 的视频。按每 5 条 cue 截取 20 个候选画面；联系表显示每个画面都对应新的访问控制、请求流向、WAF 层级或 Secret Rotation 步骤，没有纯重复帧，因此全部保留。所有截图均关闭 Transcript 侧栏、隐藏播放器控件，并根据 video 元素计算真实 16:9 媒体区域；成品无弹窗、黑边或右侧/下方裁切，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Restrict Direct Access to S3
时间范围：00:00–00:12
总结 / Summary
中文
S3 Origin Security 的目标是只允许用户通过 CloudFront 访问对象，阻止直接 S3 URL。
English
The goal of S3 origin security is to allow object access only through CloudFront and block direct S3 URLs.
Transcript
00:00 So now let's see how we can secure CloudFront
00:03 in our origin.
00:04 So for Amazon S3 buckets, we've seen this architecture,
00:08 and the idea is that we want to be able to prevent
00:10 direct access to files in our S3 buckets
2. 配置 Origin Access Control
时间范围：00:12–00:28
总结 / Summary
中文
在 CloudFront Distribution 上创建并关联源站访问控制（Origin Access Control, OAC）；它取代旧的源站访问身份（OAI）。
English
Create and associate Origin Access Control with the CloudFront distribution. OAC replaces the older Origin Access Identity mechanism.
Transcript
00:12 so that they're only accessible through CloudFront.
00:15 For this, we know we should use an Origin Access Control
00:19 and associate it with your distribution.
00:21 This was previously known as an OAI, but now it's an OAC.
00:25 And then, once the OAC has been defined on CloudFront,
3. Bucket Policy 只授权 OAC
时间范围：00:28–00:41
总结 / Summary
中文
S3 Bucket Policy 只授予 OAC GetObject 权限，用户直接请求 Bucket 时因不满足 Principal/Condition 而被拒绝。
English
The S3 bucket policy grants GetObject only to the OAC, so direct user requests are denied because they do not satisfy the required principal and conditions.
Transcript
00:28 then you edit your S3 bucket policy
00:30 so that only the OAC has the permissions to do
00:33 get object operations.
00:35 And then any user trying to access your S3 buckets
00:39 from outside your CloudFront distribution
4. Custom Origin 没有内置 OAC
时间范围：00:41–00:52
总结 / Summary
中文
ALB、Web Server 等自定义源站（Custom Origin）没有与 S3 OAC 完全相同的内置限制机制，需要自行组合应用层与网络层控制。
English
Custom origins such as ALBs and web servers do not have the same built-in restriction as S3 OAC, so application- and network-layer controls must be combined.
Transcript
00:41 will be denied because of the bucket policy.
00:45 Now it's going to get a little bit trickier
00:47 when it comes to custom origins
00:48 because there is no built-in way to do it.
00:51 So the idea is that, for example,
5. 只允许 CloudFront 访问 ALB
时间范围：00:52–01:05
总结 / Summary
中文
目标是让 ALB 或 Custom Origin 仅接受经 CloudFront Edge Location 转发的请求，而拒绝客户端直接访问 Origin。
English
The goal is for the ALB or custom origin to accept only requests forwarded through CloudFront edge locations and reject direct client access.
Transcript
00:52 say we have an application balancer
00:54 or we have an HTTP custom origin, maybe a web server,
00:57 and we only want them to be accessible from CloudFront.
01:01 So we have two ways of doing it,
01:02 and one is going to be an application logic.
6. Viewer Request 进入 Edge
时间范围：01:05–01:17
总结 / Summary
中文
Viewer Request 先进入 CloudFront Edge Location；此时只有客户端原始 Header，还没有 Origin Verification 信息。
English
The viewer request first enters a CloudFront edge location with only the client's original headers and no origin-verification value yet.
Transcript
01:05 So let's take the example of a user accessing
01:08 our CloudFront edge location
01:10 and is going to give it a few headers.
01:14 Now, CloudFront is going to be set up
01:16 so that what we get is that we're going to have
7. CloudFront 注入 Secret Header
时间范围：01:17–01:33
总结 / Summary
中文
CloudFront 向 Origin Request 注入随机 X-Custom-Header Secret，并把该值连同请求转发给 ALB 或 Custom Origin。
English
CloudFront injects a random X-Custom-Header secret into the origin request and forwards it to the ALB or custom origin.
Transcript
01:17 a custom HTTP header added to the request
01:20 that it will be sent into your ALB or your custom origin.
01:24 So the idea now is that there's an X-Custom-Header
01:28 that is customly added with some random content in it,
01:31 and this gets passed onto the origin.
8. Origin 只接受匹配 Header
时间范围：01:33–01:47
总结 / Summary
中文
Origin 可在 ALB Listener Rule 或应用逻辑中校验 Header；只有正确值才被转发，否则立即拒绝。
English
The origin can validate the header in an ALB listener rule or application logic, forwarding only matching requests and rejecting the rest.
Transcript
01:33 Now the origin can be configured
01:35 either at the ALB level or maybe your application level
01:40 to only forward requests
01:42 that contain that specific custom HTTP header,
01:45 otherwise, it'll refuse the request.
9. ALB Filtering Rule
时间范围：01:47–02:01
总结 / Summary
中文
ALB Listener 配置 Header Condition：包含预期 X-Custom-Header 时 Forward 到 EC2 Target，否则返回拒绝响应。
English
The ALB listener uses a header condition: requests with the expected X-Custom-Header are forwarded to EC2 targets, while others are rejected.
Transcript
01:47 So in the ALB, you can set up a filter and saying,
01:51 "Hey, if the request has this header,
01:53 then please forward it to your downstream instances,
01:57 else, just refuse the request."
01:59 And the idea is that if a user
10. Direct ALB Request 被拒绝
时间范围：02:01–02:13
总结 / Summary
中文
用户直接访问 ALB 时无法提供 CloudFront Secret Header，因此不匹配 Listener Rule 并被拒绝。
English
A user accessing the ALB directly lacks the CloudFront secret header, fails the listener rule, and is denied.
Transcript
02:01 tries to do a request directly against your ALB,
02:05 then your ALB will not find
02:06 the custom header it expects from CloudFront
02:08 and, therefore, will deny this request.
02:11 So, this will only work if the custom header
11. Secret 必须保密
时间范围：02:13–02:27
总结 / Summary
中文
该方法依赖 Header Name 与 Value 的保密性；若 Secret 泄露，攻击者可伪造请求绕过验证。
English
This method depends on keeping the header name and value secret. If leaked, an attacker could forge the header and bypass verification.
Transcript
02:13 name and values are kept secret, but this should be fine.
02:17 Now, you can also have a second level of security
02:20 into this setup, as we saw before,
02:22 in which we can restrict the origin
02:25 to only have a networking access
12. 叠加 CloudFront IP Allowlist
时间范围：02:27–02:38
总结 / Summary
中文
网络层再把 Origin Inbound Access 限制为 CloudFront Public IP Range，可同时获得应用层 Header 验证和网络层允许列表。
English
At the network layer, restrict inbound origin access to CloudFront public IP ranges, combining header validation with IP allowlisting.
Transcript
02:27 from the CloudFront locations.
02:29 And the CloudFront public IP addresses are available
02:31 at the URL on the bottom right corner.
02:33 So this gives you an application-level security,
02:36 as well as a network-level security
13. 双层 AWS WAF 架构
时间范围：02:38–02:50
总结 / Summary
中文
更完整的方案在 CloudFront 前部署第一层 AWS WAF，并在 ALB 前部署第二层 WAF，把 Edge Protection 与 Origin Verification 分开。
English
A fuller design places one AWS WAF in front of CloudFront and another in front of the ALB, separating edge protection from origin verification.
Transcript
02:38 to access your custom origin.
02:40 And if you wanted to post this architecture one step deeper,
02:44 we can leverage WAF as a service.
02:46 So the idea is that now we have the same architecture,
02:48 so just simplified with an ALB
14. 第一层 WAF 保护 CloudFront
时间范围：02:50–03:01
总结 / Summary
中文
Viewer Request 先由 CloudFront 关联的 WAF Web ACL 检查，再进入 Distribution；该层处理互联网侧威胁。
English
The viewer request is first inspected by the WAF web ACL associated with CloudFront, handling internet-facing threats before it reaches the distribution.
Transcript
02:50 because WAF is integrated directly with ALBs.
02:52 And so we can have a WAF rule
02:55 directly in front of CloudFront
02:56 as a first level of security.
02:58 And then CloudFront will add a custom HTTP header,
15. X-Origin-Verify 到第二层 WAF
时间范围：03:01–03:12
总结 / Summary
中文
CloudFront 添加 X-Origin-Verify Secret Header；请求在到达 ALB 前先经过第二层 AWS WAF Filtering Rule。
English
CloudFront adds an X-Origin-Verify secret header, and the request passes through a second AWS WAF filtering rule before reaching the ALB.
Transcript
03:01 for example, the X-Origin-Verify
03:02 and whatever secret value you have in mind.
03:04 And then, before reaching the ALB,
03:07 it's going to reach a second level WAF.
03:10 And this WAF will have a filtering rule set in place
16. WAF 只放行正确 Secret
时间范围：03:12–03:26
总结 / Summary
中文
第二层 WAF 仅允许带正确 X-Origin-Verify 的请求到达 ALB；校验逻辑从 ALB Listener 移到集中管理的 WAF。
English
The second WAF allows only requests with the correct X-Origin-Verify value to reach the ALB, moving validation from the listener into centrally managed WAF rules.
Transcript
03:12 so that only the request that are having this HTTP header
03:16 are passed on to the ALB.
03:19 Then, if someone tried to directly access the ALB,
03:22 it will have first to access it
03:24 through your web application firewall.
17. Direct Access 在 WAF 被拒绝
时间范围：03:26–03:38
总结 / Summary
中文
攻击者直接访问 ALB 时先遇到第二层 WAF；因为没有 Secret Header，请求在到达 ALB 前即被拒绝。
English
An attacker accessing the ALB directly encounters the second WAF first and is denied before reaching the ALB because the secret header is missing.
Transcript
03:26 And then WAF will deny this request
03:28 because it does not contain the custom HTTP header.
03:30 So this time the filtering logic happens
03:33 not at the ALB level, but at the WAF level,
03:36 which may be easier to manage.
18. Secrets Manager 自动轮换
时间范围：03:38–03:52
总结 / Summary
中文
将 Header Name/Value 存入 AWS Secrets Manager 并启用自动轮换（Automatic Rotation），避免长期使用静态 Secret。
English
Store the header name and value in AWS Secrets Manager and enable automatic rotation to avoid a long-lived static secret.
Transcript
03:38 Why? Well, because we can set up
03:40 that secret header name and value in Secrets Manager
03:44 with an auto-rotation policy for enhanced security.
03:47 And then once in a while,
03:49 this Secrets Manager will invoke a Lambda function.
19. Lambda 同步更新 CloudFront 与 WAF
时间范围：03:52–04:07
总结 / Summary
中文
Rotation Lambda Function 通过 API 同时更新 CloudFront Custom Header 与 WAF Filtering Rule，使两端持续使用相同的新 Secret。
English
A rotation Lambda function uses APIs to update both the CloudFront custom header and the WAF filtering rule so they continuously share the same new secret.
Transcript
03:52 And this Lambda function will update the custom HTTP header
03:55 with a new value in CloudFront directly using an API call,
03:58 but also update it in WAF folder filtering rule.
04:02 Meaning that we can probably rotate this every 30 days
04:04 to have maximum level of security.
20. Origin Security 分层总结
时间范围：04:07–04:18
总结 / Summary
中文
最终方案把 Edge WAF、CloudFront Secret Header、Origin WAF、IP Allowlist 与 Secret Rotation 组合为多层防护，显著降低绕过 Distribution 的风险。
English
The final design combines edge WAF, a CloudFront secret header, origin WAF, IP allowlisting, and secret rotation into layered protection that greatly reduces the risk of bypassing the distribution.
Transcript
04:07 So that's it for this lecture.
04:08 This gives you a good idea
04:09 into how you can secure network access
04:11 into your origin by limiting in CloudFront.
04:14 I hope you liked it, and I will see you in the next lecture.
整讲总结 / Overall Summary
中文
CloudFront Origin Security 的目标是阻止客户端绕过 Distribution 直接访问源站（Origin）。S3 场景使用源站访问控制（Origin Access Control, OAC）并修改 Bucket Policy，只授予 OAC GetObject 权限；直接 S3 请求因此被拒绝。Custom Origin/ALB 没有同样的内置机制，可由 CloudFront 注入随机 Secret Custom Header，并让 ALB Listener Rule、应用逻辑或第二层 AWS WAF 只接受含正确 Header 的请求。安全性还可叠加网络层允许列表，只允许 CloudFront Public IP Range 到达 Origin。更完整的架构在 CloudFront 前设置第一层 WAF，在 ALB 前设置第二层 WAF，后者校验 X-Origin-Verify。Secret Name/Value 存入 AWS Secrets Manager 并启用自动轮换（Automatic Rotation），Lambda Function 周期性同时更新 CloudFront Origin Header 与 WAF Filtering Rule，避免长期静态 Secret。
English
CloudFront origin security prevents clients from bypassing the distribution and accessing an origin directly. For S3, Origin Access Control and a bucket policy grant GetObject only to the OAC, so direct S3 requests are denied. Custom origins and ALBs lack the same built-in mechanism, so CloudFront can inject a random secret custom header and an ALB listener rule, application, or second-layer AWS WAF can accept only requests with the correct value. Network-level allowlisting of CloudFront public IP ranges provides another layer. A fuller architecture places one WAF in front of CloudFront and another in front of the ALB, with the second validating X-Origin-Verify. AWS Secrets Manager stores and automatically rotates the secret, while a Lambda function periodically updates both the CloudFront origin header and the WAF filtering rule.
返回顶部 ↑