Is it possible to publish a Dockerized application via Cloudfront, using IaC, without any ALB, NAT, or Public IPv4?

Based on the current AWS offerings and limitations, it appears that achieving your specific requirements is challenging, if not impossible, with the constraints you've outlined. Here's a breakdown of the situation:

1. CloudFront VPC Origins: This new feature would potentially solve your problem by allowing CloudFront to connect directly to resources in private subnets without the need for public IP addresses or load balancers. However, as you correctly pointed out, VPC Origins is not yet available via CloudFormation, which limits its use in Infrastructure as Code (IaC) solutions.

2. IPv6-only origins: Unfortunately, CloudFront does not currently support IPv6-only origins. CloudFront still requires IPv4 connectivity to communicate with the origin, even if IPv6 is enabled for viewer connections.

3. Avoiding ALB, NAT, and Public IPv4: These components are typically used to expose private resources to CloudFront, but you want to avoid them due to cost considerations.

4. IaC requirement: You want to use 100% IaC via CDK or CloudFormation, which further limits the options available.

Given these constraints, there doesn't seem to be a straightforward way to achieve your goal of publishing a Dockerized application via CloudFront without using ALB, NAT, or Public IPv4, while also maintaining a fully IaC approach.

The closest solution would be to use CloudFront VPC Origins, but this is not currently supported in CloudFormation. As AWS continues to develop and integrate this feature, it may become available for IaC in the future.

For now, you might need to consider compromising on one of your requirements. Options could include:

1. Using an ALB in your architecture.
2. Assigning a public IPv4 address to your container host.
3. Implementing a hybrid approach where you use IaC for most of the setup but manually configure the VPC Origin connection.

It's worth noting that AWS is actively working on expanding IPv6 support and improving integration between services, so these limitations may be addressed in future updates.
Sources
Introducing CloudFront Virtual Private Cloud (VPC) Origins: Shield your web applications from public internet | Networking & Content Delivery
Introducing Amazon CloudFront VPC origins: Enhanced security and streamlined operations for your applications | AWS News Blog
CloudFront support for IPv6 origins | AWS re:Post
Use various origins with CloudFront distributions - Amazon CloudFront