What Can AWS CloudFront See When Tor Is Part of the Architecture?
Asked by
MellowCedar47
I encountered a Tor hidden service that appeared to use Amazon CloudFront, apparently as a CDN and possibly with WAF features. I'm trying to understand what AWS would be able to determine about the service behind it.
Would AWS know the origin or backend configured for the CloudFront distribution? Does using Tor change what CloudFront can observe? Could CloudFront be involved without AWS knowing the actual infrastructure hosting the service, for example if the configured origin is another proxy, tunnel, or intermediary?
I'm mainly looking for a technical explanation of the possible architectures and what information AWS might have available through its configuration, network logs, and request handling.
Answers
CloudFront cannot directly connect to a .onion service. A conventional setup would need an intermediary such as a server running a Tor client or a separate proxy. AWS would know the origin configured in the distribution, including its hostname or address and any AWS resources involved. Tor may obscure a further hop, but it does not hide CloudFront’s own configuration from AWS.
Reply to this answer
The unusual part is that CloudFront cannot resolve or reach an onion address by itself. A Tor-related deployment would therefore need a bridge between CloudFront and the Tor network, or the onion service could be connecting outward to a regular CloudFront endpoint. Either arrangement is possible in principle, but it is not a direct CloudFront-to-onion connection and often defeats much of the normal CDN or WAF benefit.
Reply to this answer
CloudFront can be configured to contact an ordinary Internet endpoint, an AWS service, or an intermediary proxy. In that case, AWS definitely knows the immediate origin, but it may not know what lies beyond that proxy. If the proxy forwards requests into Tor, CloudFront would generally just see the proxy as another origin and would not necessarily be able to identify the ultimate hidden-service backend.
Reply to this answer
What AWS can inspect depends on how the application is built. For ordinary HTTP content, CloudFront can process requests and responses and may generate logs and metrics, while AWS retains the distribution and origin configuration. If the payload is additionally encrypted or tunneled by the application, CloudFront may only see metadata and an opaque request body, limiting caching and content-aware WAF inspection. Network-level details such as the immediate origin would still be visible.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions