In this session, we review and configure several Amazon CloudFront security features such as TLS/SSL certificate management, security groups, OAI, token authentication, and field-level encryption.

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Secure Your Site: Use CDN Security
Features to Protect Your Content
& Infrastructure
Charlie Stanley
Sr. Software Engineer
CloudFront
C T D 3 0 4 - R
Federico Casares
Software Engineer
CloudFront

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
• How Amazon CloudFront delivers content
• Using HTTPS with CloudFront
• Using alternate domain names and HTTPS
• Access control
• Restricting access to Amazon Simple Storage Service (Amazon S3) content by using an origin
access identity
• Customer origin (whitelist CloudFront IP ranges and a pre-shared secret origin header)
• Restricting the geographic distribution of your content
• Serving private content with signed URLs and signed cookies

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How CloudFront delivers content

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Using HTTPS with CloudFront
CloudFront nearest
location
Viewers Edge location
VPC
Traditional server
Host external to AWS

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Using alternate domain names and HTTPS
• Using dedicated IP addresses to serve HTTPS requests
• Using SNI to serve HTTPS requests
• Requirements for using SSL/TLS certificates with CloudFront
• Configuring alternate domain names and HTTPS
• Rotation, restrictions, and limitations

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Restricting access to Amazon S3 content by using an
origin access identity
CloudFront nearest
location
Viewers Edge location
VPC
External viewer
Allowed

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Customer origin (whitelist CloudFront IP ranges)
CloudFront nearest
location
Viewers Edge location
Allowed
VPC
Traditional server
Host external to AWS
External viewer
Only whitelisted
CloudFront IPs

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Restricting the geographic distribution of your
content
CloudFront nearest
locationViewers
US
Edge location
VPC
Viewers
FR

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Serving private content with signed URLs and signed
cookies
CloudFront nearest
location
Edge location
VPC
External viewer
Allowed
Authenticated
viewers
Non-authenticated
viewers

17. Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Charlie Stanley
Sr. Software Engineer
CloudFront
Federico Casares
Software Engineer
CloudFront

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.