We’re trying to archive this, the request has to response via cloudfront if the user to access it via AWS application load balancer user has to get the message as Access Denied.

To make it work we’ve created the application load balancer(Internet facing) with two Listeners.

HTTP:80 will forward the request to 443 only.

HTTPS:443 with 3 Rules.

Rule num 1: 403 response code with Access Denied message( If the user tried to access directly via ALB DNS name).

Rule num 2: If request matches all: HTTP Header X-Custom-Header is random-value-XXXXXXX, then only forward the request to backend and get a response.

Rule num 3: If request matches all: HTTP Header X-Custom-Header is random-value-XXXXXXX, AND Path Pattern is /blogs/*, This one we are not able to archive it, when we are trying to access it getting 503 error.

Here are our AWS Load balancers Rules and Cloudfront Behaviors

We do added our certificate on Cloud Front and Application load balancer too.

For the second Behavior we’re using the same Origin request too(we need to say same configuration as default Behavior).

Our end goal is that whenever the user hit www.example.in and www.example.in/blogs/ it has to get the response from cloudfront. if the user tried to access it via ALB DNS need to get the access denied message.