feat(cloudfront): vpc origins #33318

Tietew · 2025-02-06T13:55:27Z

Issue # (if applicable)

Reason for this change

VPC origins has been added to CloudFront and now CloudFormation supports it.
For details, see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-vpc-origins.html

Description of changes

Added an L2 construct cloudfront.VpcOrigin for AWS::CloudFront::VpcOrigin.
It will be created implicitly by origin class described below.
You can create it explicitly to share VPC origins between distributions.

import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';

// Create a VPC origin resource
const vpcOrigin = new cloudfront.VpcOrigin(this, 'VpcOrigin', {
  // An EC2 instance endpoint
  endpoint: cloudfront.VpcOriginEndpoint.fromEc2Instance(instance),
  // An Application Load Balancer endpoint
  endpoint: cloudfront.VpcOriginEndpoint.fromApplicationLoadBalancer(alb),
  // A Network Load Balancer endpoint
  endpoint: cloudfront.VpcOriginEndpoint.fromNetoworkLoadBalancer(nlb),
  // Endpoint from ARN, i.e. imported resource
  endpoint: new cloudfront.VpcOriginEndpoint({ endpointArn }),
  // Optional VPC origin resource configurations
  vpcOriginName: 'Name of the VPC origin',
  httpPort: 80,
  httpsPort: 443,
  protocolPolicy: cloudfront.OriginProtocolPolicy.MATCH_VIEWER,
  originSslProtocols: [cloudfront.OriginSslPolicy.TLSV1_2],
});

Added an origin class cloudfront_origins.VpcOrigin for distribution configuration.
It can be configured with an Application Load Balancer, a Network Load Balancer, an EC2 instance, or a cloudfront.VpcOrigin construct.

import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
import * as origins from 'aws-cdk-lib/aws-cloudfront-origins';

// An EC2 instance as a VPC origin
const ec2InstanceOrigin = origins.VpcOrigin.withEc2Instance(instance, {
  // Optional VPC origin configurations
  domainName: 'internal.example.com', // default: PrivateDnsName of the instance
  readTimeout: cdk.Duration.seconds(30),
  keepaliveTimeout: cdk.Duration.seconds(5),
  // Optional VPC origin resource configurations
  vpcOriginName: 'Name of the VPC origin',
  httpPort: 80,
  httpsPort: 443,
  protocolPolicy: cloudfront.OriginProtocolPolicy.MATCH_VIEWER,
  originSslProtocols: [cloudfront.OriginSslPolicy.TLSV1_2],
  // Optional origin common configurations
  connectionTimeout: Duration.seconds(10),
  connectionAttempts: 3,
  customHeaders: {},
  originShieldRegion: 'region-name',
  originShieldEnabled: true,
  originId: 'origin-id',
});

// An Application Load Balancer as a VPC origin
const albOrigin = origins.VpcOrigin.withApplicationLoadBalancer(alb, {
  // Optional VPC origin configurations
  domainName: 'internal.example.com', // default: DNSName of the ALB
  readTimeout: cdk.Duration.seconds(30),
  keepaliveTimeout: cdk.Duration.seconds(5),
  // Optional VPC origin resource configurations
  // Optional origin common configurations
});

// A Network Load Balancer as a VPC origin
const nlbOrigin = origins.VpcOrigin.withNetworkLoadBalancer(nlb, {
  // Optional VPC origin configurations
  domainName: 'internal.example.com', // default: DNSName  of the NLB
  readTimeout: cdk.Duration.seconds(30),
  keepaliveTimeout: cdk.Duration.seconds(5),
  // Optional VPC origin resource configurations
  // Optional origin common configurations
});

// Use an explicit VPC origin resource
const vpcOriginOrigin = origins.VpcOrigin.withVpcOrigin(vpcOrigin, {
  // Mandatory if the vpcOrigin is created without domainName
  domainName: 'internal.example.com',
  // Optional VPC origin configurations
  readTimeout: cdk.Duration.seconds(30),
  keepaliveTimeout: cdk.Duration.seconds(5),
  // Optional origin common configurations
});

Describe any new or updated permissions being added

No permissions are added automatically.
See README how to allow connections from VPC origins.

Description of how you validated changes

Unit tests and integ tests.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

Tietew · 2025-02-06T14:03:28Z

packages/aws-cdk-lib/aws-cloudfront/lib/vpc-origin.ts

+        httpsPort: props.httpsPort,
+        name: props.vpcOriginName ?? Names.uniqueResourceName(this, {}),
+        originProtocolPolicy: props.protocolPolicy,
+        originSslProtocols: props.originSslProtocols ?? [OriginSslPolicy.TLS_V1_2],


The default value of originSslProtocols is ['SSLv3', 'TLSv1'].
This explicit default ['TLSv1.2'] is same as the AWS management console.

For details, see #33318 (comment)

codecov · 2025-02-06T14:08:20Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.16%. Comparing base (a2cd7ae) to head (a92b453).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #33318   +/-   ##
=======================================
  Coverage   82.16%   82.16%           
=======================================
  Files         119      119           
  Lines        6857     6857           
  Branches     1157     1157           
=======================================
  Hits         5634     5634           
  Misses       1120     1120           
  Partials      103      103

Flag	Coverage Δ
suite.unit	`82.16% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`∅ <ø> (∅)`
packages/aws-cdk-lib/core	`82.16% <ø> (ø)`

aws-cdk-automation

(This review is outdated)

aws-cdk-automation

(This review is outdated)

Dismissing outdated PRLinter review.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

GavinZZ

I apologize in advance for not being too familiar with CloudFront and CloudFront-Origin modules.

Can you explain to me the difference between the two VpcOrigins (one of cloudfront module and one in cloudfront-origin module). It's very confusing for me and I see that in the added unit test of cloudfront-origins,

const instance = new ec2.Instance(stack, 'Instance', {
    vpc,
    instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
    machineImage: ec2.MachineImage.latestAmazonLinux2023(),
  });

  // WHEN
  new cloudfront.Distribution(stack, 'Distribution', {
    defaultBehavior: {
      origin: VpcOrigin.withEc2Instance(instance),
    },
  });

This will create a AWS resource called AWS::CloudFront::VpcOrigin but i don't see how it's being created as VpcOrigin from cloudfront-origin module doesn't create the L1 resource.

packages/aws-cdk-lib/aws-cloudfront/lib/vpc-origin.ts

GavinZZ · 2025-02-14T22:05:39Z

packages/aws-cdk-lib/aws-cloudfront/lib/vpc-origin.ts

+        httpsPort: props.httpsPort,
+        name: props.vpcOriginName ?? Names.uniqueResourceName(this, { maxLength: 64 }),
+        originProtocolPolicy: props.protocolPolicy,
+        originSslProtocols: props.originSslProtocols ?? [OriginSslPolicy.TLS_V1_2],


Which source did you see the default value? I don't see it in the CloudFormation documentation.

I created a simple CfnVpcOrigin resource:

export class VpcOrigin extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, props); const vpc = ec2.Vpc.fromLookup(this, 'Vpc', { isDefault: true }); const alb = new elbv2.ApplicationLoadBalancer(this, 'ALB', { vpc }); new cloudfront.CfnVpcOrigin(this, 'VpcOrigin', { vpcOriginEndpointConfig: { name: 'ALBVpcOrigin', arn: alb.loadBalancerArn }, }); } }

Created VPC origin in AWS management console shows the default values:

When I create a VPC origin in AWS management console, the default of SSL protocol is TLSv1.2.

GavinZZ · 2025-02-14T22:06:42Z

packages/aws-cdk-lib/aws-cloudfront/lib/vpc-origin.ts

+
+    this.vpcOriginArn = this.getResourceArnAttribute(resource.attrArn, {
+      service: 'cloudfront',
+      region: '',


is vpc origin arn region agnostic?

Yes.
See https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudfront.html#amazoncloudfront-resources-for-iam-policies

Resource types defined by Amazon CloudFront

Resource types ARN

vpcorigin arn:${Partition}:cloudfront::${Account}:vpcorigin/${Id}

GavinZZ · 2025-02-14T22:15:51Z

packages/aws-cdk-lib/aws-cloudfront-origins/lib/vpc-origin.ts

+  }
+}
+
+class VpcOriginWithVpcOrigin extends VpcOrigin {


This name is very confusing

Please see my comment at #33318 (comment)

GavinZZ · 2025-02-14T22:29:51Z

...ges/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.cloudfront-vpc-origin.ts

+  machineImage: ec2.MachineImage.latestAmazonLinux2023(),
+  vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
+});
+new cloudfront.VpcOrigin(stack, 'VpcOriginFromInstance', {


What's the purpose of this call?

This integ test verifies AWS::CloudFront::VpcOrigin resources are deployed with no errors.
The VpcOrigin resources are not attached to any CloudFront distributions in this test.

GavinZZ · 2025-02-14T23:01:44Z

packages/aws-cdk-lib/aws-cloudfront-origins/lib/vpc-origin.ts

+  }
+}
+
+class VpcOriginWithEndpoint extends VpcOrigin {


what's the use of this class if it's not exported?

Similar to S3BucketOriginWithOAC and S3BucketOriginWithOAI.
VpcOriginWith**** is used internally by VpcOrigin.with*** static methods.

S3BucketOrigin.withOriginAccessControl static method creates S3BucketOriginWithOAC.

aws-cdk/packages/aws-cdk-lib/aws-cloudfront-origins/lib/s3-bucket-origin.ts

Lines 70 to 72 in 4b0094b

public static withOriginAccessControl(bucket: IBucket, props?: S3BucketOriginWithOACProps): cloudfront.IOrigin {

return new S3BucketOriginWithOAC(bucket, props);

}

S3BucketOriginWithOAC is not exported.

aws-cdk/packages/aws-cdk-lib/aws-cloudfront-origins/lib/s3-bucket-origin.ts

Line 108 in 4b0094b

class S3BucketOriginWithOAC extends S3BucketOrigin {

aws-cdk-automation · 2025-02-17T00:13:07Z

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

Pull request has been modified.

Tietew · 2025-02-17T03:17:27Z

@GavinZZ Thank you for your review.

Can you explain to me the difference between the two VpcOrigins

cloudfront.VpcOrigin

This is the L2 construct represents AWS::CloudFront::VpcOrigin resource (CfnVpcOrigin).
The class name VpcOrigin is derived from the resource type.

This resource is very simliar to OriginAccessControl and OriginAccessIdentity.

S3BucketOrigin will create OriginAccessControl internally by default.
Users can create a OriginAccessControl resource explicitly and pass it to S3BucketOrigin.

cloudfront_origins.VpcOrigin

This is the helper class represents VPC origin similar to S3BucketOrigin class.
I agree the names of classes are very confusing...

The Origin connects to S3 Bucket - S3BucketOrigin
The Origin connects to VpcOrigin - VpcOrigin or VpcOriginOrigin ? (also confusing)

Instead, we cloud create separated origin classes:

The Origin connects to ALB as VPC origin - VpcApplicationLoadBalancerOrigin
The Origin connects to NLB as VPC origin - VpcNetworkLoadBalancerOrigin
The Origin connects to EC2 as VPC origin - VpcEc2InstanceOrigin
The Origin connects to any resource represented by VpcOrigin resource - ???

Example1 - simple usage:

declare const alb: elbv2.ApplicationLoadBalancer;

new cloudfront.Distribution(this, 'Distribution', {
  defaultBehavior: {
    origin: new origins.VpcApplicationLoadBalancerOrigin(alb),
  }
});

Example2 - create explicit VpcOrigin resource:

declare const alb: elbv2.ApplicationLoadBalancer;

const vpcOrigin = new cloudfront.VpcOrigin(this, 'VpcOrigin', {
  endpoint: cloudfront.VpcOrigin.applicationLoadBalancer(alb),
});
new cloudfront.Distribution(this, 'Distribution', {
  defaultBehavior: {
    origin: new origins.XxxxxxxxxOrigin(vpcOrigin), // How to name the class?
  }
});

Tietew · 2025-02-17T03:35:57Z

This will create a AWS resource called AWS::CloudFront::VpcOrigin but i don't see how it's being created as VpcOrigin from cloudfront-origin module doesn't create the L1 resource.

L1 resource is created here:

class VpcOriginWithEndpoint extends VpcOrigin {
  // ...
  public bind(_scope: Construct, options: cloudfront.OriginBindOptions): cloudfront.OriginBindConfig {
    this.vpcOrigin ??= new cloudfront.VpcOrigin(_scope, 'VpcOrigin', {
      endpoint: this.vpcOriginEndpoint,
      vpcOriginName: this.props.vpcOriginName,
      httpPort: this.props.httpPort,
      httpsPort: this.props.httpsPort,
      protocolPolicy: this.props.protocolPolicy,
      originSslProtocols: this.props.originSslProtocols,
    });
    return super.bind(_scope, options);
  }
}

Similar to how S3BucketOrigin creates OriginAccessControl resource.

aws-cdk/packages/aws-cdk-lib/aws-cloudfront-origins/lib/s3-bucket-origin.ts

Lines 120 to 123 in 4b0094b

    
           public bind(scope: Construct, options: cloudfront.OriginBindOptions): cloudfront.OriginBindConfig { 
        
             if (!this.originAccessControl) { 
        
               this.originAccessControl = new cloudfront.S3OriginAccessControl(scope, 'S3OriginAccessControl'); 
        
             }

packages/aws-cdk-lib/aws-cloudfront-origins/README.md

gmartenscb · 2025-02-17T09:24:54Z

packages/aws-cdk-lib/aws-cloudfront-origins/README.md

+
+// Call ec2:DescribeSecurityGroups API to retrieve the VPC origins security group.
+const getSg = new cr.AwsCustomResource(this, 'GetSecurityGroup', {
+  onCreate: {


Should the docs also provide an onUpdate and onDelete?

onUpdate is needed when the vpc id is changed but unusual.
onDelete is not needed because this custom resource creates no resources.
The security group will be deleted by CloudFront after all VPC origins (in the VPC) are deleted.

Ah okay, my bad. I thought the onDelete would be triggered when the origin would be deleted, therefore it would have to detach itself from the security group and therefore would need the security group ids and invoke this custom resource again.

Co-authored-by: Gijs Martens <gijs.martens@coolblue.nl>

GavinZZ

@Tietew thanks for the detailed answer to my questions. That's really helpful to me to understand the changes. LGTM.

mergify · 2025-02-18T19:00:06Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-02-18T19:30:07Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2025-02-18T19:30:10Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: a92b453
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

github-actions · 2025-02-18T19:30:24Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

Tietew added 7 commits February 6, 2025 15:37

CloudFront VpcOrigin resource

e1a1be7

VpcOrigin distribution origin

8ab4e90

docstrings

57c1482

originSslProtocols defaults to TLSv1.2

7e1a19f

integ test for VPC origin resource

e3c8996

integ test for VpcOrigin distribution origin

99564df

README

1c9e4b9

aws-cdk-automation requested a review from a team February 6, 2025 13:55

github-actions bot added effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 admired-contributor [Pilot] contributed between 13-24 PRs to the CDK labels Feb 6, 2025

Tietew commented Feb 6, 2025

View reviewed changes

Tietew added 7 commits February 6, 2025 23:34

fix snapshot failure

ac1eb67

ITaggableV2

a83f8b4

fix rosetta error

d53e6ec

add validations

b9f1e6c

Merge branch 'main' into cf-vpc-origin

f5ed12d

fix jsii error

8e18bbe

fix rosetta error

ed7a5d6

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Feb 7, 2025

IVpcOrigin

1053844

aws-cdk-automation previously requested changes Feb 7, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Feb 7, 2025

Merge branch 'main' into cf-vpc-origin

422e00b

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Feb 7, 2025

Tietew added 7 commits February 9, 2025 20:32

test fromVpcOriginId()

aa98044

fromVpcOriginArn() required by design guideline

ae4ccdb

Merge branch 'main' into cf-vpc-origin

9ddfa94

remove from prefix per guideline

edfa6cd

add The CloudFront managed prefix list

942b1f6

fix tests

6c8167a

fix example

4b1b738

SimonCMoore added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Feb 14, 2025

aws-cdk-automation removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. pr/needs-maintainer-review This PR needs a review from a Core Team Member labels Feb 14, 2025

GavinZZ self-assigned this Feb 14, 2025

GavinZZ previously requested changes Feb 14, 2025

View reviewed changes

Merge remote-tracking branch 'origin/main' into cf-vpc-origin

57925c2

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Feb 17, 2025

gmartenscb approved these changes Feb 17, 2025

View reviewed changes

Tietew and others added 2 commits February 17, 2025 18:41

Update packages/aws-cdk-lib/aws-cloudfront-origins/README.md

2136459

Co-authored-by: Gijs Martens <gijs.martens@coolblue.nl>

Update packages/aws-cdk-lib/aws-cloudfront-origins/README.md

90f9c62

Co-authored-by: Gijs Martens <gijs.martens@coolblue.nl>

GavinZZ approved these changes Feb 18, 2025

View reviewed changes

Merge branch 'main' into cf-vpc-origin

a92b453

mergify bot merged commit 8f3e793 into aws:main Feb 18, 2025
20 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Feb 18, 2025

Tietew deleted the cf-vpc-origin branch February 18, 2025 22:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cloudfront): vpc origins #33318

feat(cloudfront): vpc origins #33318

Tietew commented Feb 6, 2025 •

edited

Loading

Tietew Feb 6, 2025 •

edited

Loading

Tietew Feb 17, 2025

codecov bot commented Feb 6, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

GavinZZ left a comment •

edited

Loading

GavinZZ Feb 14, 2025

Tietew Feb 17, 2025

Tietew Feb 17, 2025

GavinZZ Feb 14, 2025

Tietew Feb 17, 2025

GavinZZ Feb 14, 2025

Tietew Feb 17, 2025 •

edited

Loading

GavinZZ Feb 14, 2025

Tietew Feb 17, 2025

GavinZZ Feb 14, 2025

Tietew Feb 17, 2025

aws-cdk-automation commented Feb 17, 2025

Tietew commented Feb 17, 2025 •

edited

Loading

Tietew commented Feb 17, 2025

gmartenscb Feb 17, 2025

Tietew Feb 17, 2025

gmartenscb Feb 17, 2025

GavinZZ left a comment

mergify bot commented Feb 18, 2025

mergify bot commented Feb 18, 2025

aws-cdk-automation commented Feb 18, 2025

github-actions bot commented Feb 18, 2025

	public static withOriginAccessControl(bucket: IBucket, props?: S3BucketOriginWithOACProps): cloudfront.IOrigin {
	return new S3BucketOriginWithOAC(bucket, props);
	}

feat(cloudfront): vpc origins #33318

feat(cloudfront): vpc origins #33318

Conversation

Tietew commented Feb 6, 2025 • edited Loading

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Tietew Feb 6, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov bot commented Feb 6, 2025 • edited Loading

Codecov Report

aws-cdk-automation left a comment • edited Loading

Choose a reason for hiding this comment

aws-cdk-automation left a comment • edited Loading

Choose a reason for hiding this comment

GavinZZ left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Tietew Feb 17, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aws-cdk-automation commented Feb 17, 2025

Tietew commented Feb 17, 2025 • edited Loading

cloudfront.VpcOrigin

cloudfront_origins.VpcOrigin

Tietew commented Feb 17, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

GavinZZ left a comment

Choose a reason for hiding this comment

mergify bot commented Feb 18, 2025

mergify bot commented Feb 18, 2025

aws-cdk-automation commented Feb 18, 2025

AWS CodeBuild CI Report

github-actions bot commented Feb 18, 2025

Tietew commented Feb 6, 2025 •

edited

Loading

Tietew Feb 6, 2025 •

edited

Loading

codecov bot commented Feb 6, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

GavinZZ left a comment •

edited

Loading

Tietew Feb 17, 2025 •

edited

Loading

Tietew commented Feb 17, 2025 •

edited

Loading