CDN
Intermediate 14 min read CDN

CDN Security & Access Control

The edge is also a fence

CDNs are the first line of defense: TLS, WAF, DDoS absorption, geoblocking, signed URLs/cookies and origin access restrictions keep bad traffic off your origin and private content private.

WAFsigned URLOACprotected contentgeoblockDDoSTLS
Prerequisites: Origins & Distributions
Before we start

What you will learn

  • Lock an object storage origin down so only the CDN can read it
  • Protect paid/private content with signed URLs or cookies
  • Layer WAF rules, rate limiting and geoblocking on distributions
In 60 seconds

Restrict access in two planes: origin-side (OAC/signed requests so the bucket/app only answers the CDN) and edge-side (signed URLs/cookies, WAF rules, geo/lists). Providers: CloudFront OAC, Front Door WAF policies, Cloud CDN signed URLs + IAM.

Introduction

What is this?

Origin access control: OAC (CloudFront) / managed identity + bucket policy; Front Door uses private link/managed backend auth; Cloud CDN backend bucket via service agent. Signed URLs: query-token (CloudFront key pairs / Cloud CDN HMAC / Front Door token auth) with expiry + client restrictions. Signed cookies: for multi-resource sessions. WAF: managed rule sets (SQLi/XSS/bots), rate-based rules, IP/lists, geo matching. TLS: default viewer certs vs custom ACM/Key Vault/SSL-cert per edge domain; requirements and cipher negotiation. Other: SCW/leading attack surfaces, cache poisoning defenses via strict cache keys.

Motivation

Why do you need it?

  • World-readable buckets behind a CDN are a classic exfil route — block it at the origin.
  • Paid content leaks when signed URL expiry is forgotten or keys are baked into the client.
  • WAF + rate rules at the edge drop bot floods before they consume origin capacity.
  • Geo restrictions and list-based ACLs keep content licensing and compliance sane.
Think about it

Mental model

Imagine

A guarded gate with a member badge + per-visitor day passes

Think of

Edge ACLs + signed URLs

The gate (WAF/geo) turns away randoms; the badge (valid session) opens the building; the day pass (signed URL) only works today for one named visitor.

Mechanics

How it works

  • Origin policy: only the distribution's identity can read the backing bucket (OAC + bucket policy).
  • Private content: policy on the behavior requires signed URLs/cookies; edge validates signature, expiry, principal.
  • WAF: coherent rule engine evaluates before caching — malicious traffic never reaches origin or the cache.
  • Rate-based rules track a token over a window and lift penalty responses for flooders.
  • TLS terminates at edge with a custom cert; origin may use plain HTTP inside the provider fabric.

Edge defense layers.

Client
WAF + geo
Signed URL check
Cache
Origin (OAC)
Hands-on

Examples

Signed URL token shape (provider-agnostic)

Signed URL token shape (provider-agnostic)
# CloudFront viewer restriction with CannedPolicy
https://cdn.example.com/premium/v1.m3u8
  ?Policy=<base64-policy>
  &Signature=<rsa-or-hmac-signature>
  &Key-Pair-Id=<public-key-id>
 
# prerequisites: behavior requires signed URLs or cookies

The signature ties the URL to an expiry and (optionally) an IP; the edge re-validates every component before serving the protected object.

Real world

In production

  • Video-on-demand: segment URLs signed per playback session with a 2-hour expiry.
  • Limit logins across the top: WAF managed rules on the login path drop credential-stuffing floods.
  • Regulated content: geoblocking to licensed regions plus signed cookies s.t. the origin buckets are fully lockable.
Guidelines

Best practices

  • Always add a bucket policy keyed on the OAC principal/ARN, not 'public read'.
  • Keep signing key pairs server-side; sign URLs in a trusted service, not the browser.
  • Scope signed URL expiry to the minimum (minutes-to-hours) and rotate key pairs regularly.
  • Attach managed WAF sets and test against staging before enabling enforcement.
  • Enable HTTPS-only viewer policy; disable cleartext origins where the provider allows.
Watch out

Common mistakes

  • A 'private' CDN with a public bucket — the OAC gives a false sense of security.
  • Baking long-lived signed URLs into static HTML they inevitably leak.
  • WAF enforcing in staging and accidentally disabled in production.
  • Geo-blocking the edge but leaving the origin publicly accessible from anywhere.
When things break

Debugging tips

  • 403 signature errors: first check expires against the edge's clock and the exact request serialization signs.
  • Use CloudFront logs / Front Door diagnostics to separate 4xx cause: WAF, signed URL, or origin ACL.
  • Purge after tightening a behavior — previously cached copy may still bypass the new restriction.
  • Test the origin directly to confirm you actually restricted it, not just the edge.
Interviews

Interview checkpoint

Test yourself

Quick quiz

0/2
1

Which mechanism keeps an S3 bucket private while CloudFront serves it?

2

A signed URL's signature verifies:

Go deeper

Official documentation

CloudFront signed URLs
docs
Azure Front Door WAF policy
docs