[アップデート] CloudFront VPC オリジンが CloudFormation で作成できるようになりました

AWSTemplateFormatVersion: '2010-09-09'
Description: ---

Parameters:
  VpcCidr:
    Type: String
    Default: '10.0.0.0/16'
  PrivateSubnet1Cidr:
    Type: String
    Default: '10.0.1.0/24'
  PrivateSubnet2Cidr:
    Type: String
    Default: '10.0.2.0/24'

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: Private VPC

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref PrivateSubnet1Cidr
      AvailabilityZone: !Select [0, !GetAZs '']
      Tags:
        - Key: Name
          Value: Private Subnet 1

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref PrivateSubnet2Cidr
      AvailabilityZone: !Select [1, !GetAZs '']
      Tags:
        - Key: Name
          Value: Private Subnet 2

  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: Private Route Table 1

  PrivateRouteTable2:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: Private Route Table 2

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet1
      RouteTableId: !Ref PrivateRouteTable1

  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet2
      RouteTableId: !Ref PrivateRouteTable2

  AlbSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for internal ALB
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref VpcCidr

  InternalALB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internal
      SecurityGroups:
        - !Ref AlbSecurityGroup
      Subnets:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      Type: application

  AlbListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: fixed-response
          FixedResponseConfig:
            ContentType: text/plain
            MessageBody: "Hello from ALB!"
            StatusCode: "200"
      LoadBalancerArn: !Ref InternalALB
      Port: 80
      Protocol: HTTP

Resources:

:

  HogeVpcOrigin:
    Type: AWS::CloudFront::VpcOrigin
    Properties:
      VpcOriginEndpointConfig: 
          Name: HogeVpcOrigin
          Arn: !Ref InternalALB

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        HttpVersion: http2
        DefaultCacheBehavior:
          ViewerProtocolPolicy: allow-all
          TargetOriginId: VPCOrigin
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
        Origins:
          - Id: VPCOrigin
            DomainName: !GetAtt InternalALB.DNSName
            VpcOriginConfig: 
              VpcOriginId: !GetAtt HogeVpcOrigin.Id

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: Main Internet Gateway

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  ALBSGIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      FromPort: 80
      ToPort: 80
      IpProtocol: tcp
      SourcePrefixListId: pl-58a04531
      GroupId: !Ref AlbSecurityGroup

% curl http://d1gdftjtm14ttx.cloudfront.net
Hello from ALB!