I've got a domain name foobar-staging.com, that I use for the staging environment to get feedback, testing or demo before releasing to production. Recently, decided to deploy the UI static files to s3 and everything else falling back to ALB. The original setup is only accessible privately, so the user has to connect to a VPN to be able to access foobar-staging.com, and as far as I've tested so far Cloudfront content origins need to be public, so it seems that I won't be able to keep the staging server private, unless someone confirms me otherwise?
What I want to access privately is:
Domain name > Cloudfront > s3 (/routeX, /routeY) or ALB (other routes /*)
The EC2s only have private ips and the ELB security group do not allow public access. I've allowed 80/443 0.0.0.0/16 access to see the Cloudfront work for the setup... I don't necessarily need Cloudfront (other alternative would do, as I can't route to s3 in ALB), but without having Cloudfront in front of s3 and alb, I'd have to access the UI application through the s3 amazon domain, which I'd much prefer to use the foobar-staging.com.
Is it possible to do?