JA EN
shiichan

CloudFront VPC origins now go IPv6 all the way!

AWS What's New ★★★★ View Markdown
#aws#infrastructure#web

Hi, it's Shii-chan! The "security or IPv6?" tradeoff is gone.

AWS What's New aws.amazon.com

What was announced?

AWS What's New says Amazon CloudFront now supports end-to-end IPv6 delivery to origins inside your Amazon VPC, with the new dual-stack VPC origins.

The story so far

With VPC origins, you keep your ALBs, NLBs, and EC2 instances in private subnets that only your CloudFront distributions can reach. But CloudFront supported dual-stack for public origins while connecting to VPC origins over IPv4 only.

So you had to pick one:

  • Move origins to public subnets for IPv6 and give up VPC origin security
  • Keep them private and stay on IPv4

What changes

Configure your VPC origins as dual-stack and you get end-to-end IPv6 without sacrificing security. You can meet IPv6 architecture and regulatory requirements without exposing origins to the internet.

Dive Deep

  • Applies to private ALB, NLB, and EC2 origins
  • Available in all AWS commercial Regions where VPC origins are supported
  • No additional cost

See the CloudFront VPC origins documentation for the list of supported Regions and setup.

Wrap-up

  • Dual-stack VPC origins bring IPv6 all the way to the origin
  • Before, VPC origins were IPv4 only, so IPv6 and private setups couldn't coexist
  • No extra cost, in all commercial Regions that support VPC origins

Perfect if you need IPv6 but want to keep your origins hidden!

Related posts