So I recently set up an API on an AWS EC2 instance. To be able to serve responses over HTTPS I used Route 53 to redirect my custom domain to a CloudFront distribution which points to the EC2 instance. My CloudFront distribution is served over HTTPS with a custom certificate. I am not restricting traffic at all to the API.

So my question is, is this actually a secure setup or does it give the illusion of security (I would assume the former since Amazon knows what they're doing, but I'm just wondering how)? From my understanding, serving secure content over HTTP is bad because attackers could potentially intercept requests and decode them. HTTPS prevents this by encrypting requests so that only the sender and intended receiver can understand them.

So if I make a request over HTTPS from my frontend, here's the path of the request (in my head): from the frontend, to the CF distribution, then to the EC2 instance. Now I know that sending from the frontend to the CloudFront distribution is secure because both of these are secured with SSL. However, as far as I know the connection between the CF distribution and my EC2 instance is insecure, as the EC2 serves content over HTTP.

Wouldn't an attacker (theoretically) be able to execute a man-in-the-middle attack between the CF distribution and EC2? But when I connect to my API directly from my browser, I don't get any security warnings and it shows up as SSL encrypted.

  • 2
    The answer is complex because there are so many ssl-related settings on a cloud front distribution. I might try to tackle this one later, but suffice it to say there are settings that allow you to enforce ssl between cloudfront and your server, but in the end your encryption is still terminate at the CDN edge location so that it can be cached. Whether this is acceptable is a matter of how much you trust Amazon with the data you’re transmitting. – nbering Apr 27 '18 at 3:43
  • @nbering so if the encryption has ended does that mean that requests could potentially be intercepted and decoded by a third party attacker? Or since everything is being routed between Amazon servers, is only Amazon able to view these requests? – theasianpianist Apr 27 '18 at 4:21
  • Only Amazon will be able to view the requests. – forest Apr 28 '18 at 12:15
  • But that depends if your ec2 is available on the internet and since it needs to be visible from cloudfront (with edge locations all over the world) I'm not sure how possible it is to lock the traffice between cloudfront and the ec2 down. – Michael Wiles Aug 20 '19 at 11:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.