Help improve AWS Support Official channel in re:Post and share your experience - complete a quick three-question survey to earn a re:Post badge!
Restrict a Cloudfront distribution to only ClientVPN users
I need to restrict access to a Cloudfront distribution to clientVPN users only. Idea I had was to connect them to a VPC into a NAT, and add the IP address of the NAT in the approved Ip access list of the Cloudfront, so that only them can access. Issue is that I need to put a route for this NAT into the Clientvpn - otherwise they will route it through the split tunnel through their internet. I could not find what is the best way to achieve. that last bit without having to disable split tunnel. We are using Transit Gateway and a shared networking account.
- Newest
- Most votes
- Most comments
What would be benefit of using CDN here? The Client VPN terminates inside a VPC. So your traffic would be Client -> ClientVPN into VPC -> Nat Gateway in VPC -> Out to Cloudfront PoP -> Into your Loadbalancer or S3 bucket in region. This makes an extra jump from region to Cloudfront PoP that adds latency to your connection.
In this case if you want to restrict a service to work just with the ClientVPN, make them connect to your service directly inside the private address space. For example creating a private ELB and allowing access to that from ClientVPN.
One of the use cases is to have a staging (non-prod) environment where we have the same setup as on production. However, for staging we would like to limit access for only IP's that is from our VPN network. Again, the target here is to limit access, it's acceptable that traffic will flow over the internet through HTTPS. This is a pretty common use case. Strange that AWS don't have support for it in base CloudFront setup.
However, it seems like it can be done using WAF, but enabling WAF on CloudFront only for this - sounds like a costly solution. If AWS can include the possibility to lock access only to a specific range of IP's in base CloudFront - it will be perfect. Otherwise we need to look at something like Cloudflare instead.
Relevant content
- asked 2 years ago
Here are a couple of situations where it makes sense to use cloudfront over your client vpn:
CloudFront is no longer simply a cache. It is a complex solution that allows you to do work at the edge globally, but it also lets you manipulate data in complex ways and provide a single pane of glass over lots of functions. It should support VPCs just like edge-optimized API Gateway endpoints do.