AWS CloudFront reverse proxy

In the CloudFront console, follow AWS's guide to create a CloudFront distribution.

Configure these CloudFront settings for your origin:

Origin settings:

• Origin domain: us.i.posthog.com or eu.i.posthog.com
• Protocol: HTTPS only

This tells CloudFront to forward requests to PostHog's ingestion endpoint. HTTPS only ensures all traffic is encrypted.

Default cache behavior:

• Allowed HTTP methods: GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE
• Cache HTTP methods: Check OPTIONS

PostHog needs all HTTP methods because you'll capture events (POST), retrieve feature flags (GET), and handle CORS preflight requests (OPTIONS).

In the CloudFront console, follow AWS's guide to create a cache policy.

Configure this custom policy:

• Name: posthog-cache-policy or any name you prefer
• Headers: Include Origin and Authorization
• Query strings: All

This policy tells CloudFront to include these values when caching responses. Without this, CloudFront would strip authentication headers and break event capture.

In the CloudFront console, edit your distribution's default cache behavior.

Apply these CloudFront policies:

• Cache policy: Your custom posthog-cache-policy from step 2
• Origin request policy: CORS-CustomOrigin

The CORS-CustomOrigin policy is built into AWS and forwards CORS-related headers to your origin. You don't need to create it.

Leave AWS WAF disabled for now. If you enable it later, make sure its size limit is at least 1MB for events and 64MB for session recordings. AWS WAF defaults to 8KB, which will block PostHog traffic.

In the CloudFront console, add a second origin to your distribution.

Configure this origin:

• Origin domain: us-assets.i.posthog.com or eu-assets.i.posthog.com

This origin serves PostHog's JavaScript SDK and other static files. Separating static assets from API requests allows different caching strategies.

In the CloudFront console, follow AWS's guide to create an origin request policy.

Configure this custom policy:

• Name: posthog-origin-request-policy or any name you prefer
• Headers: Include Origin
• Query strings: All

Origin request policies control what CloudFront sends to your origin, regardless of caching. This ensures PostHog receives all headers and query parameters it needs.

In the CloudFront console, add a new cache behavior to your distribution.

Configure this CloudFront behavior:

• Path pattern: /static/*
• Origin: Your assets origin, us-assets.i.posthog.com or eu-assets.i.posthog.com
• Cache policy: Your custom posthog-cache-policy from step 2
• Origin request policy: Your custom posthog-origin-request-policy from step 5
• Response headers policy: CORS-with-preflight-and-SecurityHeadersPolicy

This behavior routes requests to /static/* to your assets origin instead of the main origin. The response headers policy is built into AWS and adds CORS headers to responses.

If you encounter CORS errors after setup, you may need to create a custom response headers policy with Access-Control-Allow-Headers set to * for all headers. See AWS's CORS troubleshooting guide for details.

In your application code, update your PostHog initialization to use your CloudFront distribution domain:

posthog.init('<ph_project_api_key>', {
  api_host: 'https://d111111abcdef8.cloudfront.net',
  ui_host: 'https://us.posthog.com'
})

Replace d111111abcdef8.cloudfront.net with your actual CloudFront distribution domain. Find this in the CloudFront console under distribution domain name.

The ui_host must point to PostHog's actual domain so features like the toolbar link correctly.

Confirm events are flowing through CloudFront:

1. Open your browser's developer tools and go to the Network tab
2. Trigger an event in your app, like a page view
3. Look for a request to your CloudFront domain
4. Verify the response is 200 OK, not 403 Forbidden or 400 Bad Request
5. Check the PostHog app to confirm events appear

If you see 403 errors, your cache or origin request policies aren't forwarding required headers. Double-check your policy configurations.