25

How do you setup Cloudfront in front of an EC2 instance? I'm interested in having users hit the Cloudfront url rather than the EC2 origin.

So instead of hitting ec2-52-64-xxx-xxx.ap-southeast-2.compute.amazonaws.com users would hit d111111abcdef8.cloudfront.net.

My intention is to save money on hosting by reducing the traffic and CPU load on the EC2 instance, while providing overseas users with faster load times.

Would I just point my DNS to the Cloudfront url instead of the EC2 origin?

4 Answers 4

42

Would I just point my DNS to the Cloudfront url instead of the EC2 origin?

Pretty much.

Technically, you don't point DNS to a URL, you point it to a hostname or to an IP address, which is done a little differently with CloudFront.

First, though... in the CloudFront distribution settings, you need to configure any hostnames that CloudFront should expect to see sent by the browser, in the "alternate domain names" box.

For the origin, enter the ec2-...-compute.amazonaws.com hostname.

At this point, after 10-15 minutes, visiting the CloudFront-assigned URL should take you to your server.

Next... if your DNS is hosted in Route 53, then you'd go to the hosted zone and create new "A" records for those hostnames, setting "Alias" to "Yes," which should cause the targets box to be populated with the CloudFront distribution, which you would then select, and save the record.

If your DNS isn't hosted by Route 53, you would instead create CNAME records in DNS, pointing to the hostname assigned to the CloudFront distribution, e.g. jozxyqkexample.cloudfront.net. The catch, here, is that you can't do this with the apex/root of your domain, because a CNAME isn't valid there... so www.example.com would work, but example.com will not. This is a limitation of DNS, and the only workaround is to use Route 53 for your DNS, because it has internal integration with CloudFront (hence the "Alias" records, mentioned above, which use internal lookups rather than external referrals, like a CNAME).

You may also want to configure CloudFront to forward the Host header back to the origin server; otherwise when the request arrives, the hostname presented to your server in the HTTP requests will not be your domain name, and instead will be the hostname you configured as the origin host.

Be sure, when you connect through CloudFront, that the server doesn't redirect you back to the EC2 hostname or IP (the address bar in the browser will change, if it does, and you'll want to fix your web server's config if that happens).

15
  • Thanks for your reply Michael. The DNS is managed by NameCheap. Pointing the URL to a hostname or IP address is simple with NameCheap. But I guess you would also have to do some config in the AWS CloudFront control panel? Like point it to a URL. So it is a two way configuration?
    – ChrisRich
    Oct 15, 2015 at 5:41
  • For the origin, enter the ec2-...-compute.amazonaws.com hostname. That's how you configure CloudFront to hit your server. The step right above that is how you tell CloudFront that the hostname you're going to point at it should be associated with this particular distribution, when it sees that hostname sent by the browser on incoming requests. NameCheap's DNS service will work unless this site is your bare domain name (www.example.com ok, example.com not ok). Oct 15, 2015 at 9:05
  • 2
    I am getting this error, The request could not be satisfied. CloudFront attempted to establish a connection with the origin, but either the attempt failed or the origin closed the connection. Generated by cloudfront (CloudFront) Request ID: 9FQvbTDRYQvDABh1FgbmeMdMBA5JQmcH29bQd_yLQJ90Mf3cytZilg==
    – byteC0de
    Jul 13, 2017 at 8:39
  • @JihinRaju check stackoverflow.com/a/35258911/1695906 or stackoverflow.com/a/40519649/1695906 or stackoverflow.com/a/38725089/1695906 or serverfault.com/a/779723/153161. Incorrect SSL configuration of the origin is a common cause for this. Jul 13, 2017 at 10:19
  • 1
    I finally got it working. I can connect via Cloudfront to static sites in S3 buckets and a dynamic site through a load balancer or directly to an ec2 instance. I tore it all down and rebuilt it from scratch, and it worked. So it was some sort of cockpit error, and unfortunately, I didn't discover anything useful for others. But it did eventually work as expected. Mar 23, 2023 at 20:49
8

Use the below step to route the ec2-52-64-xxx-xxx.ap-southeast-2.compute.amazonaws.com to d111111abcdef8.cloudfront.net.

Follow below steps:

  1. Login into your aws console and search CloudFront

  2. Go to CloudFront: Create Distribution(please select Web distribution)

  3. Under Origin Settings : Select the Origin Domain Name (you can assign the Public DNS of your instance, e.g. ec2-52-64-xxx-xxx.ap-southeast-2.compute.amazonaws.com)
  4. Under Default Cache Behavior Settings : Select Viewer Protocol Policy: Redirect HTTP to HTTPS
  5. Under Object Caching: opt customize (Remain default setting in Minimum TTL , Maximum TTL and Default TTL)
  6. Forward Cookies : All
  7. Query String Forwarding and Caching : All
  8. Distribution Settings : Select Price Class: (Use All Edge Locations (Best Performance)).
  9. Alternate Domain Names (CNAMEs)s: add your domain URL name if there is any
  10. SSL Certificate : Under SSL you can opt default or your custom certificate that depends upon your requirement.(Opt default.)

Note : For Custom SSL Certificate (certificate should be in in us-east-1 region).

  1. It can took 10 to 15 minutes
3
  • i got 'parameter origin name cannot be an ip address' Dec 14, 2018 at 22:51
  • Please explain bit more so that I can help you. Dec 24, 2018 at 10:15
  • @AnoopKumar By following your instructions, I get an error 502 on the CDN pullzone : deya3mlcjkmrf.cloudfront.net Any idea ?
    – MedMatrix
    Jul 24, 2021 at 20:55
3

IP in Origin would give error: com.amazonaws.services.cloudfront.model.InvalidArgumentException: The parameter origin name cannot be an IP address. (Service: AmazonCloudFront; Status Code: 400; Error Code: InvalidArgument;

Even though AWS Documentation says you can use IP.

Public DNS (IPv4) as Origin gives '504 error The request could not be satisfied'
I've had that when Origin was S3 and if S3 has limited permissions. But EC2 has no permissions control. it is public.

4
  • @ Manly how did you get this issue resolved? Feb 18, 2021 at 11:36
  • @ Manly how did you get this issue resolved? Feb 18, 2021 at 11:36
  • 1
    Use Public IPv4 DNS name as Origin. Copy it from EC2 panel - Instance -Details tab. it looks like ec2-XX-XX-xxx-***compute.amazonaws.com Make sure it is publicly available (loading in the browser) first. I just pointing that IP address won't work, contrary to AWS Docs and someone suggestion above. Interesting, ec2 Public IPv4 DNS won't popup as S3 adress do in the Origin edit field. Jun 18, 2021 at 10:00
  • I’ve had 504 errors when EC2 was not public, for example when VPC Network interfaces and subnets are not configured. That is a different big question though. Jun 18, 2021 at 10:12
0

Leaving this answer for those, who also faced error

502 ERROR The request could not be satisfied. CloudFront wasn't able to connect to the origin. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner. If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.

If you are 100% sure that your origin has 443 port opened and the certificate on the origin is valid, you can test your Cloudfront distribution without creating a Route 53 record.

Let's say, you own "mywebiste.com" which is running on your EC2 and your Cloudfront DistributionID is a1b2c3d4e5.

Try this:

curl https://a1b2c3d4e5.cloudfront.net -H 'host: mywebiste.com' -I

That's all about host header. It must match with one from your origin SSL certificate.

3
  • how did you solve this issue? i have react app running on ec2 that's all Feb 18, 2021 at 11:38
  • I faced with issue and couldn't troubleshoot . How to solv this issue? May 2, 2022 at 19:19
  • For those still looking for an answer here, look at the origin settings in cloudfront, if your app or server is not set to run on https/443 then change the cloudfront origin setting to HTTP only, to route all traffic hitting yout cloudfront distro to port 80 on your server or app. Jun 21, 2023 at 9:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.