The Core Idea

When your backend is an actual app (not S3), CloudFront can still sit in front of it. Two ways to connect — depends on whether your infra is private or public.

Option 1 — VPC Origins (Private Subnet) ✅ Recommended

Your EC2 / ALB lives in a private subnet — never exposed to the internet. CloudFront connects to it over AWS's private network via a VPC Origin.

Users --> CloudFront Edge --> VPC Origin --> Private ALB / NLB / EC2

• EC2 and ALB do not need a public IP
• Nothing is exposed to the internet
• CloudFront handles all incoming traffic and forwards it securely
• Best for production and sensitive apps

Option 2 — Public Network

If you are not using VPC Origins, your EC2 or ALB must be public. You then lock it down so only CloudFront IPs can reach it — not random users.

EC2 as Origin

Users --> Edge Location --> EC2 (must be public)

• EC2 must have a public IP
• Security group on EC2 must allow CloudFront's IP ranges as inbound
• CloudFront IP list: http://d7uri8nf7uskq.cloudfront.net/tools/list-cloudfront-ips

ALB as Origin

Users --> Edge Location --> ALB (must be public) --> EC2 (can be private)

• ALB must be public
• Security group on ALB must allow CloudFront's IP ranges
• EC2 behind the ALB can stay private — it only talks to the ALB
• Security group on EC2 must allow the ALB's security group (not CloudFront directly)