Amazon CloudFront now supports dual-stack VPC origins, allowing IPv6 traffic to reach private origins in Amazon VPC without exposing them to the internet. This removes the prior tradeoff between IPv6 connectivity and origin security, letting customers meet regulatory requirements while keeping ALBs, NLBs, and EC2 instances in private subnets. The feature is available in all AWS Commercial Regions where VPC origins are supported at no extra cost.
How Dual-Stack VPC Origins Work
CloudFront VPC origins let customers place Application Load Balancers, Network Load Balancers, and EC2 instances in private subnets accessible only by their CloudFront distributions. Previously, connections to these origins were IPv4-only, even though CloudFront supported dual-stack for public origins. This forced a choice: move origins to public subnets for IPv6 and lose VPC origin security, or keep them private and remain on IPv4.
With dual-stack VPC origins, CloudFront can now communicate with private origins over both IPv4 and IPv6. The origin remains in a private subnet with no public IP address, and CloudFront uses IPv6 when the client and origin support it, falling back to IPv4 as needed. No changes to origin configuration are required beyond enabling dual-stack in the CloudFront distribution.
This enables end-to-end IPv6 delivery for use cases like government compliance, modern application architectures, and networks that prioritize IPv6. Since the origin never gets a public IP, the security model of VPC origins is preserved—only the specific CloudFront distribution can reach it, regardless of IP version used.
Configuration and Availability
To use dual-stack VPC origins, customers create or update a CloudFront distribution with a VPC origin and enable the dual-stack option in the origin settings. No separate IPv6-only origin is needed; the same origin handles both IP versions. The feature works with existing ALB, NLB, and EC2 origins in VPC origins configurations.
Dual-stack VPC origins are available in all AWS Commercial Regions where VPC origins are supported. AWS provides a region list in the VPC origins documentation, and there is no additional charge for using dual-stack—customers pay only for standard CloudFront data transfer and requests.
The launch removes a key barrier to IPv6 adoption in hybrid and private-cloud architectures. Teams can now align edge-to-origin traffic with IPv6-first network policies without rearchitecting origin placement or sacrificing the isolation benefits of VPC origins.
Implications for Cloud Architects
This update simplifies IPv6 compliance for industries with mandates like U.S. federal systems or EU networks that require end-to-end IPv6. Architects no longer need to duplicate origins in public subnets just for IPv6 edge connectivity, reducing operational overhead and attack surface.
It also strengthens the case for VPC origins as a default pattern for securing backend services behind CloudFront. By supporting both IP versions privately, AWS makes it easier to build homogeneous, secure, and modern network topologies without compromising on protocol flexibility.
For teams already using VPC origins, enabling dual-stack is a low-effort, no-cost change that immediately improves network alignment with modern IP standards while maintaining the same security boundaries.
Operational Best Practices
After enabling dual-stack, monitor CloudFront logs to verify IPv6 traffic is reaching origins as expected. Use VPC flow logs to confirm that only CloudFront prefix lists are allowed to communicate with the origin subnets, maintaining the zero-trust model.
Test failover scenarios by disabling IPv6 on client devices or origin endpoints to ensure IPv4 fallback works without errors. This validates resiliency in mixed-IP environments where some networks may not fully support IPv6 yet.
Document the dual-stack setting in infrastructure-as-code templates to ensure consistency across environments. Treat it as a standard origin configuration rather than a special case, reducing drift between staging and production setups.
What to do next
Review your CloudFront distributions with VPC origins and enable dual-stack in the origin settings to unlock IPv6 connectivity without exposing your backend services. Consult the AWS documentation for region-specific details and validation steps. This is a straightforward configuration update with immediate benefits for IPv6 readiness and security posture.
Source: Amazon CloudFront announces dual-stack support for VPC origins (AWS).
