Cloudfront和Alb之间的通信导致502错误

发布于 2025-02-07 02:00:36 字数 503 浏览 2 评论 0原文

我在与Alb Origin的通信中获得了CloudFront 502 错误,这导致:

CloudFront wasn't able to connect to the origin.

CloudFront Logs向我显示oildinConnectError

我来回走了问题,我不确定如何进一步调试。

任何想法都非常感谢!

详细说明

  • 我的应用程序使用通配符A-Record来处理所有子域。它可以路由到CloudFront
  • CloudFront在US-EAST-1中具有 *.example.com作为域名
  • CloudFront指向eu-west-1的Alb,而eu-west-1的证书从EU-West-1中
  • 指向Alb,别名记录直接指向ALB的工作,但我希望它指向CloudFront。因此该应用程序正在启动并运行。

I'm getting Cloudfront 502 errors in the communication to the ALB origin, which results in:

CloudFront wasn't able to connect to the origin.

The Cloudfront logs show me OriginConnectError.

I've gone back and forth regarding what the issue could be, and I'm not sure how to debug this further.

Any ideas greatly appreciated!

Detailed

  • My application uses a wildcard A-record to handle all subdomains. It routes to Cloudfront
  • Cloudfront has a certificate in us-east-1 with *.example.com as domain name
  • Cloudfront points to ALB in eu-west-1 with a different *.example.com certificate from eu-west-1
  • Creating an alias record that points directly to ALB works, but I want it to point to Cloudfront. So the App is up and running.

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(1

红墙和绿瓦 2025-02-14 02:00:37

当将CloudFront用作Origin时,我们非常常见的错误是我们忘记设置Origin请求策略,以允许CloudFront将“主机”标题转发到ALB。

  • 如果您使用有效的ACM证书为ALB创建一个自定义域,并将该域名用作CloudFront中的Origin,那么如果您直接从CloudFront Console中选择ALB DNS名称,则不会发生问题
  • ,域名现在是Alb DNS名称,运行时将失败的TLS导致502。要解决此问题,您需要将原始请求策略设置为all_viewer或all_viewer_and_cloudfront。这将告诉CloudFront将“主机”标题转发为“浏览器”中的客户端类型为ALB,该浏览器与ALB规则(与有效的ACM证书)相匹配。

希望它有帮助

Very common mistake when use CloudFront with ALB as origin is we forgot to set the Origin request policy to allow Cloudfront to forward Cloudfront "Host" header to ALB.

  • If you created a custom domain for your ALB with valid ACM Cert and use that domain name as origin in Cloudfront, then the problem won't happen
  • If you directly select ALB DNS name from Cloudfront console, the domain name is now ALB DNS name which will failed TLS when running resulted in 502. To solve this you need to set Origin request policy to ALL_VIEWER or ALL_VIEWER_AND_CLOUDFRONT. This will tell Cloudfront to forward "Host" header that client type in browser to your ALB, which matches the ALB rule (with valid ACM cert).

Hope it helps

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文