We have a use case where we wanted to allow only traffic from Cloudflare to the AWS application load balancer, which is the origin for the sub-domains which we have set up in Cloudflare. Anything which is not coming from Cloudflare should be blocked.
The complexity is that we have few services which are associated with this ALB but they are not routed from Cloudflare.
We have thought different scenarios listed below. But they have their pros and cons. We wanted to know what would be the ideal way to achieve this in this scenario.
Argo Tunnel - A VPN Tunnel between Cloudflare and the origin web server. A daemon should be running on the origin web server to support this. It will not work with ALB.
Origin Pull - A Client-authenticated TLS handshake method.
Cloudflare IP - We will use WAF before ALB to whitelist only cloudflare IP.