The edge can enforce delivery controls only when traffic reaches it. Origin restrictions make that path part of the architecture.

Address space

Point the public hostname at the distribution. Restrict origin pull. If the old A record still works, attackers will use it.

The delivery model

How it works

How a CDN protects origin

  1. 01Public edgeTerminates client traffic and applies configured controls.
  2. 02Restricted pathAccepts only approved upstream connections.
  3. 03OriginPerforms application authentication and processing.
Conceptual model for this configuration. The actual path depends on provider policy and application behavior.

L3-L7 in the path

Delivery controls can include TLS, request policies, and mitigation features depending on the service and plan. Confirm their scope and test their interaction with application authorization and origin restrictions.

Application rules are still yours

This is not a promise of every WAF signature you might want. Review current controls. Combine with origin-side auth.

DNS floods are a different layer

If the zone is on Cloud DNS, authority is DDoS-protected Anycast too. A CDN cannot save a name that does not resolve.

Validate before production

Test direct access to the origin from an untrusted network and confirm it fails without breaking health checks or management access. Validate TLS on the origin connection. Review application authorization independently of network restrictions.

  • Record the configuration and expected result before changing traffic.
  • Keep evidence of the test and a working rollback for the previous behavior.

Sources & further reading