Lecture 168: Hands On: Restrict an ALB to CloudFront
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:03
- 来源：Udemy Lecture 28556153
- Slide 数量：20
- 画面切换：00:17、00:33、00:51、01:11、01:33、01:53、02:10、02:27、02:46、03:06、03:23、03:46、04:01、04:27、04:43、05:00、05:17、05:30、05:45
扫描说明
逐条读取了 Udemy 页面中的 160 条英文 Transcript cue，并按时间轴扫描全长约 06:04 的视频。按每 8 条 cue 截取 20 个候选画面；联系表确认它们分别呈现 OAI、Bucket Policy、ALB/Target Group 创建、CloudFront Origin、Custom Header、Listener Rule、403 验证与 WAF 替代方案等连续步骤，均具有独立教学意义，因此全部保留。所有截图均关闭 Transcript 侧栏、隐藏播放器控件，并根据 video 元素计算真实 16:9 媒体区域；成品无弹窗、黑边或右侧/下方裁切，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. OAI 限制 S3 Origin Access
时间范围：00:00–00:17
总结 / Summary
中文
先回顾旧版源站访问身份（Origin Access Identity, OAI）：CloudFront 可把 S3 Bucket 的访问限制为只允许指定 OAI。
English
The demo begins with the legacy Origin Access Identity mechanism, which lets CloudFront restrict an S3 bucket so that only the selected OAI can access it.
Transcript
00:00 Okay, so let's have a look at Origin Security.
00:03 So if I create a distribution,
00:04 and choose my demo origin group,
00:07 just a random S3 Bucket.
00:09 In here, I have the option to use an OAI.
00:12 And, if I use an OAI,
00:13 then it's going to restrict the bucket access
00:16 only to this OAI,
2. 创建 OAI 并更新 Bucket Policy
时间范围：00:17–00:33
总结 / Summary
中文
创建 OAI 后选择自动更新存储桶策略（Bucket Policy），让 CloudFront 写入只读授权，避免手工配置错误。
English
After creating the OAI, choose the automatic bucket-policy update so CloudFront writes the required read-only permission and avoids manual configuration errors.
Transcript
00:17 by setting up a bucket policy.
00:19 So, I can select an origin access identity,
00:21 and for this I have to create one.
00:23 So, I can just create this one, right away.
00:26 And then select it from this list.
00:28 And then, for the bucket policy,
00:29 do we want to update the bucket policy,
00:31 to only allow read only access to the OAI?
3. OAI 建立安全的 S3 Origin
时间范围：00:33–00:51
总结 / Summary
中文
CloudFront 将 Distribution 与 S3 Origin 通过 OAI 关联，使对象不再面向任意直接请求公开。
English
CloudFront associates the distribution and S3 origin through the OAI so that objects are no longer exposed to arbitrary direct requests.
Transcript
00:33 Yes, please update the bucket policy.
00:35 And then, I will scroll down.
00:37 And this is a way to create a secure OAI
00:40 between your CloudFront distributions,
00:42 and your S3 Buckets.
00:44 So, now if I go into my S3 Buckets,
00:45 and look at properties,
00:47 and then look at the, um,
4. 检查 CloudFront 写入的 Policy
时间范围：00:51–01:11
总结 / Summary
中文
S3 Permissions 中的 Bucket Policy 已由 CloudFront 修改，只允许与 OAI ID 对应的主体（Principal）读取对象。
English
The S3 permissions page shows that CloudFront edited the bucket policy to grant object reads only to the principal associated with the OAI ID.
Transcript
00:51 I will refresh this.
00:53 Look, actually at the Permissions tabs,
00:55 and then look at the bucket policy,
00:58 as you can see the bucket policy
00:59 has been edited by CloudFront.
01:01 And, this only allows the principal, which is corresponding
01:04 to my CloudFront Origin Access identity, with this ID.
01:08 So, this is how you secure CloudFronts with S3 Buckets.
5. 创建 Internet-facing ALB
时间范围：01:11–01:33
总结 / Summary
中文
接着为 Custom Origin 创建面向互联网的应用程序负载均衡器（Application Load Balancer, ALB），跨多个可用区（Availability Zone, AZ）部署。
English
The custom-origin portion starts by creating an internet-facing Application Load Balancer across multiple Availability Zones.
Transcript
01:11 Now, lets see how we can secure CloudFronts
01:13 with an application load balancer.
01:15 So, first to do so,
01:17 what I am going to do, is to create an ALB.
01:19 So, I will go into my Load Balancers,
01:22 create a load balancer, an application load balancer,
01:26 I'll call it demo-cf-alb, it's internet-facing,
01:30 you can have it in multiple AZ's,
6. Security Group 暂时允许 Port 80
时间范围：01:33–01:53
总结 / Summary
中文
安全组（Security Group）暂时允许任意来源访问 TCP Port 80，并创建基于实例（Instance-based）的目标组（Target Group）；真正的 Origin 限制稍后在 Listener 层实现。
English
The security group temporarily permits HTTP port 80 from anywhere, and an instance-based target group is created. The actual origin restriction will be enforced later at the listener layer.
Transcript
01:33 and then click on Configure Security Settings,
01:35 Security Groups, we can create a new Security Group,
01:38 which allows anything on Port 80.
01:40 So, notice here, I'm not restricting access
01:42 just through Cloud Fronts, I'm restricting,
01:44 I'm saying you can access my ALB from anywhere.
01:48 I will do Configure Routing,
01:50 we have a new target group, I'll call it demo-tg.
7. 注册 EC2 Target
时间范围：01:53–02:10
总结 / Summary
中文
把正在运行的 EC2 实例注册到 Target Group，完成 ALB 的后端目标配置。
English
The running EC2 instance is registered with the target group, completing the ALB backend configuration.
Transcript
01:53 It's instance-based,
01:55 and then I'm going to register targets.
01:57 So, this one instance that already is running,
02:00 I'm going to add it to the registered targets.
02:03 And then click on next, Review,
02:04 and next, Create.
02:06 Okay, so we're good to go.
02:07 Let's verify that our target group does indeed
8. 验证 Target 并创建 Distribution
时间范围：02:10–02:27
总结 / Summary
中文
确认 Target 已注册后，新建 CloudFront Distribution，并准备将 ALB Domain Name 用作源站（Origin）。
English
After verifying that the target is registered, create a CloudFront distribution and prepare to use the ALB domain name as its origin.
Transcript
02:10 have my instance being registered.
02:12 Yes, it is registered,
02:13 so we're good to go.
02:15 So, now let's create a distribution,
02:18 that will be pointing to my ALB.
02:21 So, I am going to go into CloudFronts,
02:23 create a new distribution,
02:25 and the domain is going to be this one,
9. ALB 作为 HTTP Custom Origin
时间范围：02:27–02:46
总结 / Summary
中文
把 ALB Domain 配置为仅 HTTP、Port 80 的自定义源站（Custom Origin），然后等待 Distribution 部署。
English
The ALB domain is configured as an HTTP-only custom origin on port 80, and the distribution is allowed to deploy.
Transcript
02:27 so the domain name of my ALB.
02:31 It's HTTP only.
02:33 On Port 80, so we're good to go.
02:36 And then, I will scroll down,
02:38 and just create my distribution.
02:42 So, my distribution is now creating,
02:43 and I am going to pause,
02:44 up until it is fully deployed,
10. Direct ALB Access 初始可用
时间范围：02:46–03:06
总结 / Summary
中文
限制尚未建立时，直接打开 ALB URL 能成功获取 index.html；这是稍后需要关闭的绕过路径。
English
Before the restriction is added, the ALB URL successfully serves index.html directly. This is the bypass path that the next steps must close.
Transcript
02:46 as well as my ALB.
02:48 Okay, so now let's have a look,
02:49 we can access our Application directly from our ALB,
02:54 so it gets these index.html using the ALB URL.
02:57 Okay.
02:58 And, if you go to CloudFronts, and have a look
03:00 at this distribution right here,
03:04 and look at the distribution domain name,
11. CloudFront 与 ALB 都能访问
时间范围：03:06–03:23
总结 / Summary
中文
此时 CloudFront Domain 与 ALB Domain 都可访问应用；目标是保留前者并拒绝后者。
English
At this point both the CloudFront domain and the ALB domain can reach the application. The goal is to preserve the former and deny the latter.
Transcript
03:06 I can also access my index.html from CloudFronts.
03:09 Now, the idea is that we only want to be able to access
03:11 our, ALB through Cloudfront,
03:15 and not through the ALB itself.
03:17 So, what I'm going to do,
03:18 is first go into CloudFronts,
03:20 look into my Origin,
03:21 and I will edit this Origin.
12. CloudFront 添加 Secret Header
时间范围：03:23–03:46
总结 / Summary
中文
在 CloudFront Origin 上添加秘密自定义标头（Custom Header），例如 X-Custom-Secrets 与随机 Secret Value；CloudFront 会把它附加到每个 Origin Request。
English
A secret custom header, such as X-Custom-Secrets with a random secret value, is added to the CloudFront origin. CloudFront attaches it to every origin request.
Transcript
03:23 And in here, I am going to add a custom header.
03:26 I'll call it X-Custom-Secrets,
03:30 and then the Value is going to be mysupersecretsvalue.
03:36 So, what will happen is any request,
03:38 originating from CloudFronts,
03:40 is going to be sent to the ALB,
03:42 with this custom header name,
03:44 and this custom header value.
13. 准备修改 ALB Listener
时间范围：03:46–04:01
总结 / Summary
中文
保存 CloudFront Origin 变更后进入 ALB Listener Rules；访问控制将在负载均衡器收到请求时执行。
English
After saving the CloudFront origin change, open the ALB listener rules, where access control will be applied as requests arrive.
Transcript
03:46 And, these are supposed to be secrets.
03:48 So, we're going to save these changes.
03:49 And of course, as of now,
03:51 I can still access my ALB directly,
03:53 and my CloudFronts Distribution directly,
03:55 but now in the ALB we're going to
03:57 operate some changes at the Listener level.
03:59 So, I'm going to click on this Listener,
14. 匹配 HTTP Header Condition
时间范围：04:01–04:27
总结 / Summary
中文
创建 HTTP Header 条件（Condition），要求 Header Name 和 Secret Value 都与 CloudFront 配置完全一致。
English
Create an HTTP-header condition requiring both the header name and secret value to match the CloudFront configuration exactly.
Transcript
04:01 and view Edit the Rules.
04:04 In here we're going to have two things,
04:06 number one we're going to create a rule,
04:07 and say if the condition on a Http header is met,
04:13 so, the header type is going to be X-Custom-Secrets,
04:19 and then the value is mysupersecretsvalue.
04:23 Okay?
04:24 So, if the Http header is matching this,
15. 匹配请求 Forward 到 Target Group
时间范围：04:27–04:43
总结 / Summary
中文
当 Secret Header 匹配时，Listener Action 将请求转发（Forward）到 demo-tg Target Group；随后编辑默认规则处理不匹配请求。
English
When the secret header matches, the listener action forwards the request to the demo-tg target group. The default rule is then edited to handle nonmatching requests.
Transcript
04:27 then the Action is going to be to forward
04:29 to my Target Group, demo-tg.
04:32 And, I'm going to save this.
04:34 And then, I'm going to edit the last rule,
04:35 so I click on Edits,
04:37 and then edit the last rule.
04:38 And so, if otherwise, the request
04:41 does not contain this Http header,
16. 默认返回 Fixed 403 Response
时间范围：04:43–05:00
总结 / Summary
中文
删除默认 Forward Action，改为固定响应（Fixed Response）403，并以 unauthorized 作为响应正文，从而拒绝没有正确 Header 的请求。
English
Replace the default forward action with a fixed 403 response whose body says unauthorized, denying every request that lacks the correct header.
Transcript
04:43 then instead of forwarding to the Target Group,
04:45 then, we'll delete this rule.
04:47 And, we'll just add an action,
04:49 and say, return a fixed response of "403".
04:53 And then the Content-Type
04:54 is going to be "unauthorized", as a body.
04:59 Okay?
05:00 Then we'll update this.
17. 完成 Listener Rule 分流
时间范围：05:00–05:17
总结 / Summary
中文
最终 Listener Rule 形成明确分流：Header 匹配则 Forward 到 Target Group，否则走 Default Rule 返回 403。
English
The completed listener rules create a clear split: matching headers are forwarded to the target group, while all other requests hit the default 403 rule.
Transcript
05:00 And so we're saying, okay if the Http header
05:02 does contain we're expecting it to contain,
05:04 then forward it to the Target Group,
05:06 else, do not return the response.
05:09 So, we're good to go.
05:10 CloudFront has been updated.
05:12 Let's have a look at the Distribution,
05:14 it is not being deployed, so this is all good.
18. CloudFront Access 继续成功
时间范围：05:17–05:30
总结 / Summary
中文
CloudFront Request 自带 Secret Header，因此仍能通过 ALB Rule 并获得正常 index.html 响应。
English
CloudFront requests include the secret header, so they still pass the ALB rule and receive the normal index.html response.
Transcript
05:17 And, so now let's have a look
05:18 at the behavior of this.
05:19 So, if I try to access from CloudFront,
05:22 and refresh, as you can see,
05:23 this is still working.
05:24 I still have access
05:25 to this "Hello, this is index.html page"
05:27 But, if I go to my ALB and refresh,
19. Direct ALB Access 被拒绝
时间范围：05:30–05:45
总结 / Summary
中文
浏览器直接访问 ALB 时没有 CloudFront 注入的 Header，因此命中 Default 403 Rule 并显示 unauthorized，成功阻断绕过路径。
English
A browser accessing the ALB directly lacks CloudFront's injected header, hits the default 403 rule, and receives unauthorized, closing the bypass path.
Transcript
05:30 I get an "unauthorized" response back.
05:32 That's because my Web Browser did not include
05:34 this custom Http header that I had from CloudFronts.
05:38 And so, effectively, what we've done,
05:39 is that we've set up a level of security.
05:42 Another way you could do this,
05:43 and I will now do it,
05:44 just to show you that the option exists,
20. 可用 AWS WAF 替代 Listener Rule
时间范围：05:45–06:03
总结 / Summary
中文
另一种实现是在 ALB 前集成 AWS WAF，由 Web ACL Rule 按 HTTP Header 过滤；这样无需修改 ALB Listener Rules。
English
An alternative is to integrate AWS WAF in front of the ALB and let a web ACL rule filter on the HTTP header, removing the need to modify ALB listener rules.
Transcript
05:45 is that you could integrate your ALB with your WAF.
05:50 And, in WAF you would set up a rule
05:51 to do the filtering based on the Http filter,
05:54 removing the need to edit your Listener rules.
05:57 Okay, so this is another way of doing it.
05:59 So, that's it for this demo,
06:00 I hope you liked it.
06:01 And I will see you in the next lecture.
整讲总结 / Overall Summary
中文
本实操先演示旧版源站访问身份（Origin Access Identity, OAI）如何通过存储桶策略（Bucket Policy）限制 Amazon S3 源站，再将同一“仅允许 CloudFront 访问源站”的目标应用到应用程序负载均衡器（Application Load Balancer, ALB）。CloudFront 为发往 ALB 的源站请求（Origin Request）注入秘密自定义标头（Custom Header）；ALB 监听器规则（Listener Rule）只把标头名称和值都匹配的请求转发到目标组（Target Group），其余直接返回固定 403 响应。结果是经 CloudFront 的访问继续成功，而绕过 CloudFront 直接访问 ALB 会收到 unauthorized。也可以用 AWS WAF 按相同 HTTP Header 条件过滤，以替代 ALB Listener Rule。
English
This hands-on lesson first shows how the legacy Origin Access Identity mechanism restricts an Amazon S3 origin through a bucket policy, then applies the same only-through-CloudFront objective to an Application Load Balancer. CloudFront injects a secret custom header into origin requests. An ALB listener rule forwards requests to the target group only when both the header name and value match; every other request receives a fixed 403 response. Access through CloudFront therefore continues to work, while direct access to the ALB returns unauthorized. AWS WAF can enforce the same HTTP-header condition instead of ALB listener rules.
返回顶部 ↑