Restricting Access to Your EC2 Instances Only from CloudFront

Why Limit Traffic to CloudFront?

Restricting inbound traffic to only CloudFront helps prevent direct access from the internet, reduces attack surface, and ensures that all user requests pass through the CDN's caching and edge optimizations.

Prerequisites

Before configuring the security group, you need:

• CloudFront distribution ID or alternate domain name (CNAME).
• Knowledge of the IP ranges CloudFront uses, which change frequently.
• An existing security group attached to your target EC2 instances.

Step 1: Retrieve CloudFront IP Ranges

Amazon publishes a JSON file listing current IP ranges. Use the following command to download it:

curl https://ip-ranges.amazonaws.com/ip-ranges.json -o ip-ranges.json

Filter the list for the CloudFront service:

jq -r '.prefixes[] | select(.service=="CLOUDFRONT") | .ip_prefix' ip-ranges.json > cloudfront-ips.txt

Repeat this process weekly or automate it with a Lambda function to keep the list up to date.

Step 2: Create or Update the Security Group

In the EC2 console or using AWS CLI, add inbound rules that allow traffic only from the IP ranges extracted. Example CLI command for a single CIDR block:

aws ec2 authorize-security-group-ingress \ --group-id sg-0123456789abcdef0 \ --protocol tcp \ --port 80 \ --cidr 13.52.0.0/15

Repeat for each IP prefix. To simplify, you can import the list into a Terraform or CloudFormation template.

Step 3: Verify Traffic Flow

After updating the security group, test with curl from a non‑CloudFront IP to confirm rejection:

curl -I http://your-ec2-public-dns

You should receive a connection timeout or reset. Then test from CloudFront's edge (e.g., using the distribution URL) to ensure the request succeeds.

Maintenance Strategy

CloudFront IP ranges update weekly. Automate the update by:

• Setting a scheduled Lambda that downloads the JSON, parses it, and updates the security group via the EC2 API.
• Using AWS Config rules to alert when the security group deviates from the approved list.

Implementing a CI/CD pipeline that includes the security group definition ensures consistency across environments.

Common Pitfalls

Overly Broad CIDR Blocks – Using large subnets can expose unintended IPs. Always use the precise prefixes provided.

Missing HTTPS Ports – If CloudFront serves HTTPS, remember to allow port 443.

Failing to Update on IP Changes – Without regular updates, new CloudFront edge nodes may be blocked, causing legitimate traffic loss.

Conclusion

By tying your EC2 security group rules to CloudFront's dynamic IP ranges, you enforce a strict access policy that protects backend resources while preserving CDN benefits.