Ref: https://learn.cantrill.io/courses/1820301/lectures/41301526

• Summary:
• Contents:

CF Origins and Origin Groups

• 🔧 CF origins store content that CF distributes via edge locations

  • If CF receives request & object is stale or not cached → origin fetch
  • Origin group → more resiliency
    • Several origins in group in case main origin is not available

• Defined at behavior level

• Types of origins

  1. S3 origins
     • S3 buckets
     • AWS media package channel endpoints
     • AWS media store container endpoints
  2. **Custom origins**
     • Web servers
  • ❗ Available features & restrictions differ between S3 origins and custom origins

• ‼️ An S3 bucket configured with static website can be either an S3 origin or a custom origin!!

  • Origin specified with S3 bucket → S3 origin
  • Origin specified with DNS name of the S3 static website hosting endpoint → custom origin

• Features common to both S3 and custom origins:

  

  • Origin domain → points directly at origin
    • AWS origin (e.g. S3 bucket) or DNS name
  • Origin path → use particular path inside origin
    • e.g. /img inside S3 bucket to access images

CF - S3 Origins

• 💡 Simplest to integrate, little configuration needed

• Features:

  

  • Origin access → make S3 origin only accessible via CF distribution (restricts access)
    • Origin access control (OAC) → recommended
    • Origin access identity (OAI) → legacy
  • Custom headers (passed through to origin)
  • ❗ Origin protocol policy ALWAYS matches Viewer protocol policy
    • Can't mix HTTP and HTTPS in the communication → either all HTTP or all HTTPS

CF - Custom Origins

• 💡 More granular configuration options

• Features:

  

  • Origin protocol policy: HTTP-only, HTTPS-only, or match viewer protocol policy
  • Ports for HTTP and HTTPS connections
    • Default: 80 for HTTP and 443 for HTTPS
    • 💡 S3 doesn't have configurable ports → can't change them in S3 origins
  • Minimum origin SSL protocol
    • Best practice: select latest version supported by origin (maximum security)
    • Ref for supported SSL/TLS protocols & ciphers for viewer-CF communication: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html#secure-connections-supported-ciphers
  • Custom headers
    • Can be used to secure custom origins (custom origins can’t use OAC nor OAIs!)

CF - S3 Origins vs Custom Origins - Summary Table