Browser/curl sends HTTPS request to CloudFront domain.
DNS resolves to nearest CloudFront POP.
▼ HTTPS
Terminates TLS, evaluates cache behavior, applies WAF rules.
On cache miss, routes to VPC Origin via Global Accelerator tunnel.
ID: E2NYFVP1KKUH2
Domain: d2c2cecv1o051r.cloudfront.net
Behavior: /* → VPC Origin (ALL methods)
Timeouts: ReadTimeout=120s, KeepAlive=120s
▼ IPv6 tunnel, port 444
CloudFront-managed tunnel connects the edge POP to your private VPC.
Traffic enters through managed ENIs placed in your subnets.
No IGW, no public IPs needed.
VPC Origin: vo_3pL776Bv22dCGShyu43L1h
Protocol: HTTPS-only, TLSv1.2
ENI 2a: 10.0.1.194 (eni-0abc11ee)
ENI 2b: 10.0.2.117 (eni-0722bbd3)
▼ HTTPS :443 (within VPC)
Receives HTTPS from CF managed ENIs. Terminates TLS with ACM cert.
Forwards HTTP to target group. Health checks on port 80.
Name: cf-poc-internal-alb
Scheme: internal (no public IP)
Cert: vpc-poc.bepomar.site (ACM)
SG: cf-poc-alb-sg (443 from VPC + CF prefix list)
Subnets: 10.0.1.0/24 (2a) + 10.0.2.0/24 (2b)
▼ HTTP :80
Simple nginx web server responding on port 80.
Registered in target group. Only reachable from within the VPC.
ID: i-0a14b5db8caf54e12
IP: 10.0.1.88
Type: t3.micro (AL2023)
SG: cf-poc-ec2-sg (80 from VPC)
Subnet: cf-poc-private-2a (10.0.1.0/24)
✓ Request served successfully — this page traveled: Edge POP → GA tunnel → VPC ENI → ALB → EC2
VPC: vpc-0bbd2f925fd9d591f (cf-vpc-origin-poc) | Region: us-east-2 | CIDR: 10.0.0.0/16 | No IGW, fully private