AWS CloudFront & VPC: Updating EC2 ARN with ASG

Select Language:

If you’re looking to set up Amazon CloudFront to deliver content from a web application running on a single EC2 Spot Instance within a private Virtual Private Cloud (VPC), here’s a straightforward approach.

First, it’s important to understand that you want to manage your EC2 instance with an Auto Scaling Group (ASG), even though you only have one instance. This is because Spot Instances can be flaky—they might terminate unexpectedly—so using an ASG ensures your instance is managed properly. However, your setup has a key challenge: you want to avoid using Application or Network Load Balancers (ALB/NLB) and also avoid assigning a public IP to your EC2 instance.

The tricky part is that CloudFront’s VPC Origin feature requires a static mention of the origin, typically an ARN (Amazon Resource Name) referencing an ALB, NLB, or specific EC2 instance. Since you’re avoiding using ALBs and NLBs, and your EC2 instance is managed dynamically by an ASG with service discovery using Cloud Map, there’s no static ARN to reference. This creates a problem because CloudFormation, the tool you’re using to deploy infrastructure, expects a fixed ARN for the origin.

So, what’s the best way to make this work? Crafting a custom resource to dynamically fetch and set the correct origin ARN can be one solution, but it’s often more straightforward to adapt your architecture to fit within the native constructs of AWS.

One effective approach is to create a static resource, like a dedicated NAT Gateway or a Jump Box, that can serve as the stable endpoint for CloudFront. Alternatively, you can configure your EC2 instance with a static private IP address and reference it directly in your CloudFront origin configuration. This way, you avoid the need for complex custom resources and keep everything within the standard AWS framework.

In summary:
– Use an Elastic IP or a static private IP for your EC2 instance.
– Reference that IP directly when configuring CloudFront as the origin.
– Ensure your security groups and network ACLs allow communication between CloudFront and your EC2 instance.
– Manage your EC2 instance via ASG for reliability, but keep its IP address fixed for CloudFront.

This approach provides a more native, manageable setup without the complexity of custom resources or additional load balancers. It keeps your architecture lean, cost-effective, and compliant with your constraints, all while ensuring that CloudFront can reliably serve your application content.