Skip to content

documentations update#49

Merged
Buffden merged 1 commit into
mainfrom
security-policies
Apr 8, 2026
Merged

documentations update#49
Buffden merged 1 commit into
mainfrom
security-policies

Conversation

@Buffden
Copy link
Copy Markdown
Owner

@Buffden Buffden commented Apr 8, 2026

The DNS resolution path and the actual TCP connection are two different things.
After DNS resolves tinyurl.buffden.com:

  • If the record is orange-cloud (proxied) in Cloudflare → DNS returns Cloudflare's anycast IP, so the user's browser connects to Cloudflare's edge, not CloudFront. Cloudflare then forwards upstream to CloudFront.
  • If the record is grey-cloud (DNS-only) → DNS returns CloudFront's IP → user connects to CloudFront directly. The arrow would be correct but then Cloudflare's WAF/DDoS protection doesn't apply to SPA traffic. Since the whole point of the setup is Cloudflare absorbing traffic before it reaches AWS, tinyurl.buffden.com should be orange-cloud proxied — meaning the correct flow is: User → Cloudflare edge → CloudFront → S3

…nt things. After DNS resolves tinyurl.buffden.com:

  - If the record is orange-cloud (proxied) in Cloudflare → DNS returns Cloudflare's anycast IP, so the user's browser connects to Cloudflare's
  edge, not CloudFront. Cloudflare then forwards upstream to CloudFront.
  - If the record is grey-cloud (DNS-only) → DNS returns CloudFront's IP → user connects to CloudFront directly. The arrow would be correct but then
   Cloudflare's WAF/DDoS protection doesn't apply to SPA traffic.
  Since the whole point of the setup is Cloudflare absorbing traffic before it reaches AWS, tinyurl.buffden.com should be orange-cloud proxied —
  meaning the correct flow is:
  User → Cloudflare edge → CloudFront → S3
@Buffden Buffden merged commit 97ebac5 into main Apr 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant