Lecture 170: End-to-End Encryption in CloudFront
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：02:12
- 来源：Udemy Lecture 33170810
- Slide 数量：2
- 画面切换：00:08
扫描说明
逐条读取了 Udemy 页面中的 48 条英文 Transcript cue，并按时间轴扫描全长约 02:12 的视频。画面围绕 CloudFront、Application Load Balancer（ALB）和 EC2 Instance 的端到端 HTTPS 架构逐步补充要求；标题/架构引入与完整配置说明分为两个小节，动画构建合并后使用信息完整的最终画面。截图在 Transcript 侧栏关闭、播放器控件隐藏后截取并统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. CloudFront、ALB 与 EC2 的端到端 HTTPS
时间范围：00:00–00:08
总结 / Summary
中文
本讲讨论如何让 CloudFront、Application Load Balancer（ALB）和 Amazon EC2 Instance 之间的两段连接都使用 HTTPS，从而形成 Viewer 到应用服务器的端到端加密链路。
English
This lecture explains how to use HTTPS on both links among CloudFront, an Application Load Balancer, and an Amazon EC2 instance, creating end-to-end encryption from the viewer-facing distribution to the application server.
Transcript
00:00 So, how do you enable end-to-end encryption
00:02 between CloudFront, your ALB,
00:04 and your EC2 instance to use HTTPS all the way?
2. 每一跳的证书与验证要求
时间范围：00:08–02:12
总结 / Summary
中文
CloudFront 的 Origin Protocol Policy 必须设为 HTTPS Only，ALB 需要配置有效的 SSL/TLS 证书。该证书的域名必须匹配 CloudFront Origin Domain，或匹配转发到 Origin 的 Host Header；CloudFront 会验证证书，因此 ALB 不能使用自签名证书，可使用 ACM 签发或导入 ACM 的第三方证书。ALB 到 EC2 的连接也要启用 HTTPS，但 ACM 证书不能导出到 EC2，因此实例应使用第三方证书或自签名证书。ALB 只利用后端证书加密连接而不验证证书本身，所以 EC2 使用自签名证书是可行的。
English
CloudFront must use an Origin Protocol Policy of HTTPS Only, and the ALB must present a valid SSL/TLS certificate. Its name must match either the CloudFront origin domain or the forwarded Host header. Because CloudFront validates the origin certificate, the ALB cannot use a self-signed certificate; it can use an ACM-issued certificate or a third-party certificate imported into ACM. The ALB-to-EC2 link must also use HTTPS, but ACM certificates cannot be exported to EC2. The instance therefore uses a third-party or self-signed certificate. This works because the ALB encrypts the backend connection but does not validate the instance certificate.
Transcript
00:08 So on the end of CloudFront
00:10 you must specify the Origin protocol policy
00:15 So CloudFront communicates
00:16 with the ALB using HTTPS and then your custom Origin
00:20 which is a load balancer in this instance
00:23 must have an SSL or TLS certificate that is valid.
00:28 And the certificate domain name must be
00:31 either what we set for the Origin domain field
00:34 which we configure in CloudFront,
00:35 or if we're using the Host header from the clients
00:38 and it's forwarded to the Origin
00:40 then the host editor must match the domain
00:42 of the TLS certificate on your ALB.
00:46 So, because the domain itself is going to be verified
00:49 by CloudFront, you cannot use self-signed certificate.
00:53 It must be a certificate issued, for example
00:56 by AWS Certificate Manager or by a third party service.
01:01 Now, the configuration
01:02 on your application load balancer is that, as I said,
01:05 you must use a certificate provided
01:07 by the AWS Certificate Manager or third party
01:11 but then imported into the AWS Certificate Manager
01:16 and then your load balancer will have correct configuration.
01:20 And then of course you must set
01:21 up your EC2 instance to have SSL.
01:24 And so, as you know, or as you may know
01:27 the AWS Certificate Manager Service, ACM,
01:30 is not supported on EC2.
01:32 You cannot export certificates from ACM.
01:35 So therefore for your EC2 instance to set up SSL or TLS
01:39 you must use a third party,
01:41 or you can use a third party SSL certificate
01:44 for any domain name actually,
01:46 because there's no verification
01:48 or you can even use a self-signed certificate
01:52 on your EC2 instance,
01:53 because the ALB is not going
01:54 to verify the certificate itself.
01:56 It's just going to use the certificate
01:58 to encrypt the connection.
02:01 Once you have all that in place
02:03 then you will have end-to-end encryption
02:04 between CloudFront, your ALB, and your EC2 instance.
02:08 I hope you liked it and I will see you
02:10 in the next lecture.
整讲总结 / Overall Summary
中文
要实现 CloudFront → ALB → EC2 的端到端加密，两段链路都必须使用 HTTPS。CloudFront 会严格验证 ALB 的 Origin Certificate，因此该证书必须有效、域名匹配且不能自签名；ALB 到 EC2 的后端连接则可以使用自签名证书，因为 ALB 不验证实例证书。ACM 证书不可导出到 EC2，是选择实例证书来源时的关键限制。
English
End-to-end encryption across CloudFront, an ALB, and EC2 requires HTTPS on both links. CloudFront validates the ALB origin certificate, so it must be valid, name-matched, and not self-signed. The ALB-to-EC2 link may use a self-signed certificate because the ALB does not validate the instance certificate. ACM certificates cannot be exported to EC2, which is the key constraint when choosing the instance certificate source.
返回顶部 ↑