Lecture 169: CloudFront and HTTPS
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：03:59
- 来源：Udemy Lecture 28556159
- Slide 数量：4
- 画面切换：00:03、01:35、02:30
扫描说明
逐条读取了 Udemy 页面中的 96 条英文 Transcript cue，并按时间轴扫描全长约 03:59 的视频。课程画面包含标题页、Viewer/Origin 协议策略、Alternate Domain Names 和 CloudFront SSL/TLS Certificates 四个主题画面；同一页中的项目符号动画构建合并到对应小节，并采用信息完整的最终画面作为截图。截图在 Transcript 侧栏关闭、播放器控件隐藏后截取并统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. CloudFront HTTPS 概览
时间范围：00:00–00:03
总结 / Summary
中文
本讲聚焦 Amazon CloudFront 的 HTTPS 配置，核心是区分两段独立连接：Viewer 到 Edge Location，以及 Edge Location 到 Origin。后续的协议策略、证书与自定义域名都围绕这两个边界展开。
English
This lecture focuses on HTTPS configuration for Amazon CloudFront. The key is to separate the two independent connections: viewer to edge location, and edge location to origin. The protocol policies, certificates, and custom-domain settings all apply to one of these boundaries.
Transcript
00:00 So now as talk about CloudFront and HTTPS.
2. Viewer Protocol Policy 与 Origin Protocol Policy
时间范围：00:03–01:35
总结 / Summary
中文
查看器协议策略（Viewer Protocol Policy）决定客户端如何连接 CloudFront Edge Location，可允许 HTTP 与 HTTPS、把 HTTP 重定向到 HTTPS，或只允许 HTTPS。源站协议策略（Origin Protocol Policy）决定 Edge Location 如何连接 Origin，可选择 HTTP Only、HTTPS Only 或 Match Viewer。S3 Static Website Endpoint 不支持 HTTPS，因此这类源站只能使用 HTTP；Custom Origin 若使用 HTTPS，其 SSL/TLS 证书必须有效并可被 CloudFront 信任，不能使用自签名证书。
English
The Viewer Protocol Policy controls how clients connect to a CloudFront edge location: allow HTTP and HTTPS, redirect HTTP to HTTPS, or require HTTPS. The Origin Protocol Policy controls how the edge connects to the origin: HTTP only, HTTPS only, or match the viewer. An S3 static website endpoint does not support HTTPS, so CloudFront must use HTTP to that origin. A custom HTTPS origin must present a valid certificate trusted by CloudFront; self-signed certificates are not accepted.
Transcript
00:03 So we have two connections happening,
00:05 one within the client and the edge location,
00:07 and one within the edge location and the origin.
00:10 So the Viewer Protocol Policy
00:11 is how the client connects to the edge location.
00:15 So it could be HTTP and HTTPS.
00:17 And we can also have the option to tell CloudFront
00:19 to redirect any request that is HTTP
00:22 into an HTTPS request for security.
00:25 Or you can say for example,
00:26 that you only want to allow HTTPS
00:28 and refuse anything that is HTTP based.
00:30 For me, personally, I like the second option
00:32 because it allows even bad request
00:34 to be transformed into good request into HTTPS.
00:38 Now, for the Origin Protocol Policy,
00:40 this is how the edge location connects into your origin.
00:43 And you have HTTP only, or you have HTTPs only,
00:48 or you have a match viewer,
00:49 which means that if the viewer is doing a request on HTTP,
00:53 then it will match the viewer policy
00:54 and so therefore send a request in HTTP form to the origin.
00:58 Or if the request of the viewer is HTTPS,
01:01 then also match that and send the request to the origin
01:03 in HTTPS form.
01:05 Now, a few things to note
01:07 is that your S3 buckets static websites
01:09 do not support HTTPS so you have no other choice
01:12 but to use the HTTP Origin Protocol Policy
01:15 from your edge location into an S3 bucket
01:17 setup as a static websites.
01:19 And also if you want to have the CloudFront
01:22 to connect to your origin correctly,
01:24 they need to make sure
01:25 that your SSL or TLS certificates on your origin are valid
01:29 and recognized by CloudFront
3. Alternate Domain Names 与证书覆盖范围
时间范围：01:35–02:30
总结 / Summary
中文
Alternate Domain Names（也称 CNAME）允许用户用自己的域名（例如 www.example.com）替代默认的 cloudfront.net 域名访问 Distribution。CloudFront Distribution 必须配置这些域名，并绑定由受信任证书颁发机构（Certificate Authority, CA）签发的有效 SSL/TLS 证书。证书需要覆盖主域名和所有配置的 Alternate Domain Names；可使用通配符证书（例如 *.example.com）简化多个子域名的覆盖。
English
Alternate Domain Names, also called CNAMEs, let users access a distribution with a domain such as www.example.com instead of the default cloudfront.net name. The distribution must list those names and use a valid SSL/TLS certificate issued by a trusted Certificate Authority. The certificate must cover the primary domain and every alternate domain name; a wildcard such as *.example.com can simplify coverage for multiple subdomains.
Transcript
01:35 Now, for Alternate Domain Names.
01:36 So this is when you want to use your own domain name
01:38 instead of the domain name assigned by CloudFront
01:40 to your distribution.
01:42 So instead of using a CloudFront URL that looks like this,
01:45 you want to maybe use ww.example.com,
01:48 which is a domain name that you own.
01:50 So in this case, CloudFront will be set up by you
01:54 with alternate domain names.
01:55 For example, ww.example.com or star.example.com,
02:00 and we will have to load a proper SSL or TLS certificate
02:02 onto CloudFront.
02:04 We set up these domain names
02:05 directly onto the CloudFront distribution,
02:07 and then our users are able to access
02:10 our CloudFront distribution
02:11 using a URL that we would expect.
02:14 For this, we must have a valid SSL/TLS certificate
02:17 that will cover your domain name
02:18 and any alternate domain name that you set up
02:21 as part of your distribution.
02:23 It is possible for you, for simplicity's sake,
02:25 to use a wildcard certificate
02:27 and cover a wide array of domain names.
4. CloudFront SSL/TLS Certificates
时间范围：02:30–03:59
总结 / Summary
中文
默认 CloudFront 证书（*.cloudfront.net）可直接保护 AWS 分配的 Distribution 域名。使用自定义域名时，需要 Custom SSL Certificate；推荐使用 Server Name Indication（SNI），也可以为每个 Edge Location 使用成本更高的 Dedicated IP。证书可由 AWS Certificate Manager（ACM）签发，也可把第三方证书导入 ACM 或 IAM Certificate Store，但导入证书需要手工轮换。CloudFront 使用的证书必须创建或导入到 US East (N. Virginia) Region（us-east-1）。还可选择 Security Policy，规定最低 SSL/TLS 协议版本和允许的 Cipher Suites。
English
The default CloudFront certificate (*.cloudfront.net) protects the distribution domain assigned by AWS. A custom domain requires a custom SSL certificate. Server Name Indication (SNI) is the recommended delivery option, while dedicated IP addresses at edge locations are more expensive. Certificates can be issued by AWS Certificate Manager or imported from a third party into ACM or the IAM certificate store; imported certificates require manual rotation. A CloudFront certificate must be created or imported in US East (N. Virginia), us-east-1. A security policy can also set the minimum SSL/TLS version and allowed cipher suites.
Transcript
02:30 Okay, now let's talk about these SSL certificates.
02:33 So there's the default CloudFront certificate
02:35 that we get by default whenever we create a distribution,
02:37 which is star .cloudfront.net
02:40 and this is, for example, one of these distributions.
02:42 So this is where we get HTTPS out of the box with CloudFront
02:46 when using a CloudFront URL.
02:48 And if you want to load your custom SSL or TLS certificate,
02:52 then you would serve it in two ways.
02:55 So either CloudFront will serve the HTTP request using SNI,
02:58 which recommended,
02:59 so CloudFront will know which SSL certificate to use
03:02 based on the request it receives,
03:04 or we can have a level of security that is expensive,
03:08 which is to use dedicated IP address in each edge location.
03:12 So for this, we can use the certificates
03:13 that are generated directly
03:15 from AWS Certificate Manager or ACM,
03:18 or we can upload it third-party certificates
03:20 directly into ACM or the IAM certificate store.
03:23 But in this case, you have to manually rotate them
03:26 when they expire.
03:27 Now, these certificates must live
03:29 in the US East Northern Virginia region,
03:33 and the reason is because CloudFront
03:34 is assigned to that region
03:36 even though it is a quote, unquote global service.
03:39 Then you are also able to similarly,
03:42 as we did it with the ELB,
03:44 to set up a security policy
03:46 in which we specify the minimum protocol
03:48 for the SSL/TLS in ware as well as which ciphers to use.
03:52 So that's it for HTTPS security on CloudFront.
03:56 I hope you liked it,
03:56 and I will see you in the next lecture.
整讲总结 / Overall Summary
中文
CloudFront HTTPS 需要分别设计 Viewer-to-Edge 与 Edge-to-Origin 两段链路。Viewer Protocol Policy 控制客户端是否可用 HTTP、是否重定向到 HTTPS，Origin Protocol Policy 控制 CloudFront 回源时使用 HTTP、HTTPS 或匹配 Viewer。自定义域名必须配置为 Alternate Domain Name，并由覆盖所有相关域名的有效证书保护。CloudFront 的自定义证书位于 us-east-1，推荐使用 SNI；同时可通过 Security Policy 约束最低 TLS 版本和 Cipher Suites。S3 Static Website Endpoint 只能通过 HTTP 回源，这是考试中容易混淆的重要限制。
English
CloudFront HTTPS must be designed as two separate links: viewer-to-edge and edge-to-origin. The Viewer Protocol Policy controls whether clients may use HTTP or are redirected to HTTPS, while the Origin Protocol Policy controls whether CloudFront uses HTTP, HTTPS, or matches the viewer when contacting the origin. A custom domain must be configured as an Alternate Domain Name and protected by a valid certificate covering every relevant name. CloudFront custom certificates reside in us-east-1, SNI is the recommended delivery method, and a security policy can restrict the minimum TLS version and cipher suites. An S3 static website endpoint can only be contacted over HTTP, an important exam constraint.
返回顶部 ↑