Protection you could walk around
The client's website and platform sat behind a CDN with a WAF. But the origin load balancer in the cloud still accepted direct traffic from the internet. Anyone who found the origin's IP could go around the whole protection.
Closing that door looked like one firewall rule: block everything not coming from the CDN. In practice, three pieces had to change together and in the right order. The root domain can't be a CNAME, by a rule of DNS itself, and the client's DNS didn't support ALIAS records. So the root domain pointed to a fixed CDN IP, configured by hand: if the CDN changed that IP, the site went down. Order mattered too, because blocking the origin before DNS pointed to the CDN would take the site down. And server metrics collection went through exactly the path that was about to be closed.
Rehearse first
I validated the whole flow in a proof of concept before touching production, and that's where the 403 errors showed up when enabling the block on the load balancer's firewall. With those fixed, I restricted the origin: the firewall now accepts only the CDN's IPs.
Automating what depends on someone else
The fragile point was still depending on IPs that weren't ours. I wrote two Python scripts. The first syncs the CDN's current IPs into the DNS records of the domains that can't use a CNAME. I refactored the logic into a generic function, which let me include a subdomain that still pointed straight to the origin, and fixed a bug in dry-run mode: in Python, the string "false" is truthy. The second script keeps the CDN's IPs up to date in the firewall allowlist.
So monitoring would survive the block, I changed metrics collection to discover the autoscaling instances' IPs through the cloud API, without going through the closed path. I also supported the APM proof of concept, with a reverse proxy and TLS certificates, a wildcard included, for the collector.
A redirect that broke images
Midway through, a redirect started breaking images, and the first suspect was DNS. I showed with tests that DNS was right and the problem was the CDN's redirect rule, which dropped the URL path. The origin server, by comparison, preserved it. Separating DNS from CDN saved a wrong change.
What changed
The origin is no longer directly reachable: all traffic comes in through the CDN and the WAF. The fixed-IP risk is automated away, so if the CDN changes its IPs, DNS and the firewall update themselves. Server monitoring kept working after the block.
What I take from it
Edge security isn't a firewall rule, it's a coordinated change across DNS, CDN, firewall and monitoring. And anything that depends on an IP you don't control needs to be automated, or it becomes an outage waiting for its moment.