So I recently set up an API on an AWS EC2 instance. To be able to serve responses over HTTPS I used Route 53 to redirect my custom domain to a CloudFront distribution which points to the EC2 instance. My CloudFront distribution is served over HTTPS with a custom certificate. I am not restricting traffic at all to the API.
So my question is, is this actually a secure setup or does it give the illusion of security (I would assume the former since Amazon knows what they're doing, but I'm just wondering how)? From my understanding, serving secure content over HTTP is bad because attackers could potentially intercept requests and decode them. HTTPS prevents this by encrypting requests so that only the sender and intended receiver can understand them.
So if I make a request over HTTPS from my frontend, here's the path of the request (in my head): from the frontend, to the CF distribution, then to the EC2 instance. Now I know that sending from the frontend to the CloudFront distribution is secure because both of these are secured with SSL. However, as far as I know the connection between the CF distribution and my EC2 instance is insecure, as the EC2 serves content over HTTP.
Wouldn't an attacker (theoretically) be able to execute a man-in-the-middle attack between the CF distribution and EC2? But when I connect to my API directly from my browser, I don't get any security warnings and it shows up as SSL encrypted.