Using cross-account CloudFront VPC origins for multi-account private API Gateway architecture

This article explains how to use CloudFront's new cross-account VPC origins feature to build multi-account private API Gateway architectures with team-specific subdomains.

• CloudFront now supports VPC origins in separate AWS accounts from distributions
• Teams maintain autonomous private APIs while sharing centralized CloudFront distribution
• Team-specific subdomains (team-a.example.com, team-b.example.com) enable isolated routing
• AWS RAM facilitates secure cross-account VPC origin sharing without compromising security
• Single CloudFront distribution reduces costs versus separate per-team distributions
• Architecture requires three accounts: two team accounts and one networking account
• Implementation includes VPC setup, private API Gateway, ALB, and path-based CloudFront behaviors
• Host header validation ensures seamless request flow without Lambda@Edge complexity

This pattern enables organizations to balance team autonomy, security isolation, and operational efficiency in multi-account AWS environments.