如何将EC2 Web应用特定URL请求转发至AWS CloudFront？

Great question! Let's break this down clearly—first off, Route 53 can't handle path-level forwarding on its own because it's a DNS service. It only maps your domain (like example.com) to an endpoint (your existing CloudFront distribution, an EC2 instance, etc.) and doesn't inspect or route based on URL paths like /files/*. But don't worry, there are several straightforward ways to get this working using AWS services you already use or can easily integrate.

Option 1: Add a Custom Behavior to Your Existing CloudFront Distribution #

Since you already have a CloudFront distribution set up (with EC2 as the primary origin and S3 as a failover), this is the simplest approach. You can configure CloudFront to route /files/* requests directly to your S3 bucket:

• Open the CloudFront console, select your existing distribution, and go to the Behaviors tab.
• Click Create Behavior:
  • Set the Path Pattern to /files/* (this tells CloudFront to match any request starting with /files/).
  • Under Origin or Origin Group, select your S3 bucket (you'll need to add it as an origin first if you haven't already).
    • Important: Use a CloudFront Origin Access Identity (OAI) to restrict S3 access only to CloudFront (don't make the bucket public). Update your S3 bucket policy to allow the OAI to read objects.
  • Configure cache settings, viewer protocol policy (e.g., redirect HTTP to HTTPS), and other options to match your needs.
• Save the behavior. CloudFront will prioritize this specific path rule over your default behavior (which routes to EC2).

Option 2: Use an Application Load Balancer (ALB) as Your CloudFront Origin #

If you need more flexibility (like routing to a separate CloudFront distribution for S3 files), you can place an ALB between CloudFront and your EC2 instance:

• Create an ALB and register your EC2 instance as a target in a target group.
• Add a listener rule to the ALB:
  • Set the rule condition to match the path /files/*.
  • Set the action to forward requests to your S3-backed CloudFront distribution (or directly to the S3 bucket's REST endpoint, though CloudFront is recommended for caching and security).
• Update your existing CloudFront distribution to use the ALB as its primary origin instead of EC2. Now CloudFront sends all requests to the ALB, which routes /files/* traffic to your S3/CloudFront setup and everything else to EC2.

Option 3: Use Lambda@Edge for Advanced Routing #

For more dynamic scenarios (like conditional routing based on other request attributes), you can use Lambda@Edge to modify requests at the CloudFront edge locations:

• Create a Lambda function (in the us-east-1 region) that runs on the Origin Request event.
• In the function code, check if the request path starts with /files/. If yes, rewrite the request's origin to point to your S3 bucket or S3-backed CloudFront distribution.
• Associate this Lambda function with your existing CloudFront distribution's default behavior.

Key Notes #

• When using S3 with CloudFront, always use an OAI to secure your bucket—never make it public unless absolutely necessary.
• CloudFront behavior rules are evaluated in order, so make sure your /files/* behavior is listed above the default behavior (you can reorder behaviors in the console).

内容的提问来源于stack exchange，提问作者SnazzyBootMan