<p>My solution is based on signed cookies (find how to implement it here, <a href="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-cookies.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-cookies.html</a>); I've created a lambda that handles this for me a bit differently, as I need users to access a location to get their cookie in the easiest way possible and have someone control to whom can be granted the auth cookie. An example of a basic implementation of this is here: <a href="https://aws.amazon.com/blogs/compute/simply-serverless-using-aws-lambda-to-expose-custom-cookies-with-api-gateway/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/compute/simply-serverless-using-aws-lambda-to-expose-custom-cookies-with-api-gateway/</a></p>

<p><a href="https://i.sstatic.net/GyJ5F.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/GyJ5F.png" alt="enter image description here"></a></p>

<p>Finally, after you have provided your Content origin in Cloudfront, in the Behaviors tab where you setup the Content origin desired behaviour you need to set "Restrict Viewer Access (Use Signed URLs or Signed Cookies)".</p>

<p>Obs: make sure you also forward all cookies and query strings.</p>

CC BY-SA 4.0
2019-12-20T15:37:10.593Z
2019-12-20T15:50:02.297Z
2019-12-20T15:50:02.297Z
punkbit
<p>I've got a domain name foobar-staging.com, that I use for the staging environment to get feedback, testing or demo before releasing to production. Recently, decided to deploy the UI static files to s3 and everything else falling back to ALB.
The original setup is only accessible privately, so the user has to connect to a VPN to be able to access foobar-staging.com, and as far as I've tested so far Cloudfront content origins need to be public, so it seems that I won't be able to keep the staging server private, unless someone confirms me otherwise?</p>

<p>What I want to access privately is:</p>

<pre><code>Domain name &gt; Cloudfront &gt; s3 (/routeX, /routeY) or ALB (other routes /*)
</code></pre>

<p>The EC2s only have private ips and the ELB security group do not allow public access. I've allowed 80/443 0.0.0.0/16 access to see the Cloudfront work for the setup... I don't necessarily need Cloudfront (other alternative would do, as I can't route to s3 in ALB), but without having Cloudfront in front of s3 and alb, I'd have to access the UI application through the s3 amazon domain, which I'd much prefer to use the foobar-staging.com.</p>

<p>Is it possible to do?</p>

CC BY-SA 4.0
2019-12-20T11:38:44.143Z
Did you solve the issue?
030
CC BY-SA 4.0
2019-12-20T15:17:28.297Z
Yes, I did. I'll post the solution, but I'm on mobile at the moment traveling.
punkbit
CC BY-SA 4.0
2019-12-20T15:18:24.170Z
Ok great. Please let me know once you posted an answer.
030
CC BY-SA 4.0
2019-12-20T15:39:13.897Z
@030 I've answered it, as long you understand the concept of what I built, you'll be able to come up with your own solution hopefully. Good luck!
punkbit
<amazon-web-services><load-balance><amazon-cloudfront>
How to setup Cloudfront for Load balancer for a private staging domain name?
punkbit
# How to setup Cloudfront for Load balancer for a private staging domain name?

(Asked by: username_0 on 2019-10-26)

I've got a domain name foobar-staging.com, that I use for the staging environment to get feedback, testing or demo before releasing to production. Recently, decided to deploy the UI static files to s3 and everything else falling back to ALB.
The original setup is only accessible privately, so the user has to connect to a VPN to be able to access foobar-staging.com, and as far as I've tested so far Cloudfront content origins need to be public, so it seems that I won't be able to keep the staging server private, unless someone confirms me otherwise?
What I want to access privately is:
Domain name > Cloudfront > s3 (/routeX, /routeY) or ALB (other routes /*)

The EC2s only have private ips and the ELB security group do not allow public access. I've allowed 80/443 0.0.0.0/16 access to see the Cloudfront work for the setup... I don't necessarily need Cloudfront (other alternative would do, as I can't route to s3 in ALB), but without having Cloudfront in front of s3 and alb, I'd have to access the UI application through the s3 amazon domain, which I'd much prefer to use the foobar-staging.com.
Is it possible to do?

**Tags:** amazon-web-services, load-balance, amazon-cloudfront

> **Comments:**
> **username_1**: Did you solve the issue?  
> **username_0**: Yes, I did. I'll post the solution, but I'm on mobile at the moment traveling.  
> **username_1**: Ok great. Please let me know once you posted an answer.  
> **username_0**: @username_1 I've answered it, as long you understand the concept of what I built, you'll be able to come up with your own solution hopefully. Good luck!  

---

## 1 answers

### Answer by username_0 on 2019-12-20. Score: 1 | Accepted answer

My solution is based on signed cookies (find how to implement it here, <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-cookies.html>); I've created a lambda that handles this for me a bit differently, as I need users to access a location to get their cookie in the easiest way possible and have someone control to whom can be granted the auth cookie. An example of a basic implementation of this is here: <https://aws.amazon.com/blogs/compute/simply-serverless-using-aws-lambda-to-expose-custom-cookies-with-api-gateway/>

[![enter image description here](https://i.sstatic.net/GyJ5F.png)](https://i.sstatic.net/GyJ5F.png)

Finally, after you have provided your Content origin in Cloudfront, in the Behaviors tab where you setup the Content origin desired behaviour you need to set "Restrict Viewer Access (Use Signed URLs or Signed Cookies)".

Obs: make sure you also forward all cookies and query strings.


---

