A CloudFront distribution uses an ALB as its origin. Viewers reach CloudFront over HTTPS, but origin fetches fail after the ALB stopped accepting HTTP. The origin protocol policy is still HTTP only. What should change?
Select an answer to reveal the explanation.
Short Explanation
The front door is locked to visitors who still knock with the old handshake. CloudFront is still speaking HTTP to your ALB, and that ALB now requires HTTPS. Match the origin protocol policy to HTTPS, because changing only the viewer side leaves the origin knock on HTTP.
Full Explanation
The origin protocol policy controls the protocol CloudFront uses toward the origin, separate from the protocol viewers use toward CloudFront. HTTP only makes CloudFront connect to the ALB with HTTP. After the ALB stops accepting HTTP, those origin connections fail even though viewers already use HTTPS to CloudFront. Setting the origin protocol policy to HTTPS only makes the origin connection match the listener that is still open. Putting an HTTP listener back on the ALB reverses the requirement that the load balancer take HTTPS. The viewer protocol policy changes only the client edge. It does not change an origin policy that is pinned to HTTP. An ALB is addressed by its DNS name, not by a raw address you pin, and keeping HTTP only would still fail against an HTTPS-only listener. Caveat: the certificate on the ALB must match the origin domain name CloudFront sends, and the ALB security group must allow HTTPS from CloudFront. Operational check: a cache-miss request should succeed, and the ALB log for that request should show HTTPS rather than a failed HTTP connection.