CloudFront must reach an application that runs on a private instance. An operator wants the instance private IP published in a public DNS record and used as the origin domain. What should the origin be instead?
Select an answer to reveal the explanation.
Short Explanation
Writing a house back-room number on a public billboard does not build a road to that room. A private IP in a public DNS record is not an origin your distribution can reach. Use an origin CloudFront can actually reach, such as a public ALB or a VPC origin.
Full Explanation
CloudFront edge locations on the public internet cannot open a connection to an RFC 1918 address just because a public DNS record contains that address. The origin has to be something the distribution can reach: an ALB you intentionally publish, or a CloudFront VPC origin aimed at a private ALB, network load balancer, or instance. Publishing the private IP in a public hosted zone, with or without a protocol change, still leaves an unroutable target. An interface endpoint serves clients inside a VPC. Putting its name in a public zone does not turn it into a CloudFront origin for this private instance. Caveat: a public ALB is a choice to expose that load balancer, while a VPC origin keeps the origin in a private subnet and is a different path. Either one is reachable by the distribution. The private IP in public DNS is not. Operational check: the origin domain should be the ALB or the VPC origin, a test request should return the application, and no public record should contain the instance private address.