Technical Change Notice | Amazon CloudFront and AWS WAF | October–November 2026

1. Overview

CQG is transitioning the listed HTTPS application entry points to Amazon CloudFront with AWS WAF. CloudFront and WAF provide a globally distributed web entry point and inspect incoming web requests before forwarding permitted traffic to CQG Globally Distributed Services. CQG application services are not being moved into AWS as part of this change.

The test hostnames below have already changed and are available for connectivity testing. The remaining hostnames are planned to change in November; individual cutover dates and times have not been specified in this notice.

Global Security Architecture

f1

Figure 1. CloudFront and AWS WAF protect access to CQG Globally Distributed Services.

2. What Is Changing

  • Public destination IP addresses will change and may continue to change as AWS updates its global CloudFront edge network.
  • TLS certificates presented at these HTTPS entry points will change. Systems that pin a certificate or public key may need updates.
  • AWS WAF security rules will inspect incoming requests. Depending on configured rules, some requests may be challenged or blocked, including automated access.
  • Customers should continue using the published CQG HTTPS hostnames rather than assuming a fixed destination IP address.
  • The CloudFront/WAF layer is an entry-point change; it does not, by itself, replace all other CQG application connectivity requirements.

3. Hostnames Available for Testing (After October 23, 2026)

4. Hostnames Planned to Change in November

5. How to Test

  1. Open the relevant test link from the computer and network you normally use to access CQG.
  2. Confirm that the page loads without a connection error, certificate warning, or network block.
  3. If you use a corporate VPN or more than one work network, repeat the check through those connections.

Loading the page confirms initial connectivity. It does not by itself verify sign-in or every application function.

If a test link does not load, share the URL and error message with your IT team or your usual CQG support representative. Include the time of the test, your time zone, and whether you were connected through a VPN.

6. Information for IT and Network Administrators

The move to CloudFront may require updates where access is restricted by destination IP address, hostname, firewall policy, or web proxy rules.

Review outbound HTTPS access on TCP port 443 to the production and test hostnames listed above. Where supported by your security policy and network equipment, use hostname-based rules for these CQG endpoints.

These hostnames identify the entry points covered by this change; they are not a complete list of application dependencies. Retain existing CQG connectivity rules unless CQG advises otherwise.

TLS and Automated Access

These endpoints will use Amazon-issued certificates (Amazon Trust Services), which renew automatically. Because certificates and keys will change over time, we recommend standard certificate authority validation rather than pinning a specific certificate or public key. Scripted clients and automated tools should be tested for WAF challenge or block behavior.

7. CloudFront IP Address Ranges

Amazon maintains the authoritative information at the following resources:

For IP-based rules, follow Amazon's guidance for CloudFront edge ranges. In the AWS JSON file, Amazon identifies the relevant records with service: CLOUDFRONT and region: GLOBAL. Review IPv4 and IPv6 entries as applicable to your network.

CloudFront origin-facing managed prefix lists serve a different purpose: allowing CloudFront to reach servers hosting content. They are not the appropriate lists for customer connections to CloudFront.

CloudFront ranges are shared across AWS customers; an IP allowlist alone does not limit access to CQG.

8. Keeping IP-Based Rules Current

AWS IP ranges can change. If your organization maintains IP-based rules, establish a process to keep them current.

Amazon provides: AWS IP Address Range Change Notifications 

9. Need Assistance?

Contact your usual CQG support representative with the affected service, test URL, error message, and test time (including your time zone). For access problems, also include your source IP address, whether a VPN was used, and any reference code shown on the error page.