CloudFront VPC Origin with ECS-EC2 (non-Fargate) Service

You need to create a VPC origin first, specifying your EC2 instance ARN (example screenshot below). You can find your instance ARN from EC2 console details section. After origin has been successfully created, create a new CloudFront distribution referencing this origin.

More from blog Introducing Amazon CloudFront VPC origins: Enhanced security and streamlined operations for your applications

When setting up CloudFront VPC Origin with an ECS-EC2 (non-Fargate) service, you need to consider how CloudFront will connect to your containerized applications running on EC2 instances.

For your scenario where EC2 instances are serving as capacity providers for ECS, there are a few important considerations:

1. CloudFront VPC Origin requires a stable endpoint to connect to within your private subnet. Since your ECS tasks may be dynamically scheduled across different EC2 instances, you need a consistent way for CloudFront to reach them.

2. Using Cloud Map Service Discovery is indeed a good approach for this scenario. Cloud Map can register each task's Elastic Network Interface (ENI) and provide service discovery, allowing CloudFront to connect to your application regardless of which EC2 instance is hosting it at any given time.

3. When configuring the CloudFront VPC Origin, you'll need to:

• Ensure your VPC has an internet gateway
• Configure your network ACLs with appropriate inbound and outbound rules
• Update security groups to allow the CloudFront managed prefix list
• Make sure you have at least one available IPv4 address in your private subnet

4. For the "Origin domain" field, you would use the private DNS name provided by Cloud Map for your service rather than directly using an EC2 instance's private IP DNS name. This ensures that requests are properly routed to your ECS tasks regardless of which EC2 host they're running on.

5. Remember that the CloudFront VPC Origin feature is designed to enhance security by allowing your application to run in a private subnet while still being accessible through CloudFront, eliminating the need to expose your instances directly to the internet.

This approach provides better security and operational efficiency for your ECS-EC2 based application while leveraging CloudFront's global distribution network.
Sources
Best Practices for Protecting EC2 Behind CloudFront | AWS re:Post
Use CloudFront VPC origins to secure applications | AWS re:Post
VpcOrigin - Amazon CloudFront