All of the tutorials I read pertain to an Elastic Beanstalk Load Balancer, which I am not using with a Single Instance.
I can access my app deployed through Elastic Beanstalk by either using the environment url or simply redirecting my Route 53 Type A record to either the Elastic Beanstalk environment or the ec2 public domain.
I want my webapp use HTTPS, so I created an SSL Cert through ACM and attempted to deploy the cert on my webapp through CloudFront. I created a CloudFront distribution domain but this is where I am stuck: I cannot use my Elastic Beanstalk environment as an Origin Domain, only an S3 bucket.
How do I get CloudFront to talk to Elastic Beanstalk/EC2?
Directly accessing S3 is not an option, not only do I get 403 errors but my project is an Angular App and .NET WebApi, which needs to be deployed and run, not simply accessed from an S3 folder. I also cannot bypass CloudFront and put the cert in my project, because you cannot download ACM certs.
it should communicate with ElasticBeanstalk in HTTPS right?
Sadly this is not how it works. To have HTTPS between CF and EB, you must have valid, public SSL certificate on your EB instance. You can't use self-signed certificates nor EB gives you any SSL by default. If you do not have ALB on EB, you have to get SSL certificate from a third party (not ACM), such as LetsEncrypt and deploy in on the instance. You also must have your own domain for that to work.
Only if the above is satisfied, you will have HTTPS on the entire path:
Client --- (https) --> CF ---- (https) ----> EB
Otherwise, you can only have:
Client --- (https) --> CF ---- (http) ----> EB
Which is a security risk as you use http (plain text) over the internet.
Related
Context: Right now I have an Angular static site setup on S3, a domain registered through Route53, and SSL through Cloudfront. I have an express backend on Elastic Beanstalk that I want to interface with using https. The EB app has a load balancer and nginx proxy by default.
Possible Solutions:
Assign my load balancer a SSL certificate but it seems I can only do this with a custom domain at least through the AWS certificate manager. It does give me the option to use the certificate I generated from the frontend but I'm not sure if that is a good idea.
Add an origin on my cloudfront that points to my EB express app. I'm not sure if this is secure or even possible. The idea is that I could make API calls from www.myapp.org (s3 hosted) to www.myapp.org/api (EB hosted).
Get a new custom domain and give that an ssl certificate and point it to my EB app?
If there are any other options, I would be happy to hear about them.
I am trying to add HTTPS connection to the server API I have in elastic beanstalk, using CloudFlare as DNS. Steps I have followed:
Go to AWS certificate manager and create a certificate for *.nameofmydomain.com
Verified the certificate
Created a listener in elastic beanstalk loader section, port 443 and the previously created certificate
Created a CNAME record in cloudflare that points api.nameofmydomain.com to the elastic beanstalk (xxxxx.yyyyy.eu-west-1.elasticbeanstalk.com)
When I open the https://xxxxx.yyyyy.eu-west-1.elasticbeanstalk.com I get the following error
And when I open the api.nameofmydomain.com I get this
I found the issue, turns out that wildcard ACM certificates in AWS only work for one level, and I was trying to create a domain in that was xxx.yyy.nameofmydomain.com changing it to just one level made it work
I have enabled HTTPS for my custom domain name (haydenclay.page), but I also need the Beanstalk url (app-name.elasticbeanstalk.com) to run through HTTPS as well.
HTTPS does not work currently, because the cert name matches my custom domain name, yielding: ERR_CERT_COMMON_NAME_INVALID
I need HTTPS because I make API requests, and going from HTTPS to HTTP throws a mixed content error. How can I enabled HTTPS on the beanstalk url?
I have already tried making an alias
Sadly you can't enable https directly for app-name.elasticbeanstalk.com domain. This is because this domain is controlled by AWS. You can only register SSL certificates for domains that you control.
If you want to server your content from EB over ssl, you have generally three options.
Front your instance with load balancer. This is the easiest* way as you can associated ACM SSL certificate with the balancer for your domain.
Front your EB instance with CloudFront (CF). You can setup alternative name for your cloudfront domain with your CF distro and your SSL cert. You can also use ACM for that. Also easy setup, but it should be noted that traffic between CF and your EB instance will be http only, unless you also setup your own SSL cert (not from ACM) on the instances (point 3).
Install your own SSL certificate (not from ACM) directly on the EB instance, using nginx. This requires manual setup and a valid public certificate. Popular choice is LetsEncrypt, to get the SSL cert from.
If you use CloudFlare, go to DNS -> Records
Type: CNAME
name: api
Content: "YOUR_URL.eu-west-1.elasticbeanstalk.com"
Proxy status: Proxied
And call your new url: api.your_domain.com
Background
I am trying to deploy a dummy application with React frontend and Django backend interacting via REST api. I have done the following:
Use a S3 bucket to host static website and deploy my react code to it
Put Cloudfront for S3 bucket - set up certificate and changed my domain name (from GoDaddy) to link to this address
Kicked off Elastic Beanstalk environment following the python environment tutorial of AWS
Set up Postgres RDS and linked the Django server with it
So now I can do the following
Access my frontend using https via my domain name (https://www.example.com)
Access django admin site using the path of elastic beanstalk and update items
i.e. each component is up and running
Problem
I am having trouble with:
Making a secure REST API call from the static page to Elastic Beanstalk environment. Before I set up certificates I could easily make REST API calls.
The guides I can find usually involve putting a domain name for Elastic Beanstalk, which I imagine does not apply to my case (or does it?)
I tried to follow this faq and updated configuration in load balancer that accepts 443 https and redirects to 80 http. But I am using same certificate as from CloudFront, which does not sound right to me.
Would appreciate help with
how to solve the above ssl connection issue
or is there a better architecture for what I'm trying to achieve here?
According to Request a certificate in ACM for Elastic Beanstalk backend, it sounds like I have to use a subdomain and request a certificate for that subdomain, and use Cloud 53 to direct requests to that subdomain to Elastic Beanstalk environment. Would that be the case?
Thank you in advance!
By default EB url will HTTP only. To use HTTPS you need to deploy SSL certificate on your ALB.
In order to do that you need a custom domain, because you can only associated an SSL certificates with domains that you control. Thus, normally you would get a domain (you seem to already have one from godaday). So in this case you can setup a subdomain (e.g. api.my-domian.com) on godady. Then you can use AWS ACM to register a free public SSL certificate for api.my-domian.com.
Once the certificate is verified, using either DNS (easier) or email technique, you deploy it on your ALB using HTTPs listener. Obviously you will need to point api.my-domian.com to the EB's https url. You can also redirect on your ALB http traffic from port 80 to 443 to always use https.
Then in your front-end application you only use https://api.my-domian.com, not the original EB url.
There can be also CORS issues alongside this, so have to be vary of them as well.
I am trying to setup HTTPS across my app which consists in a frontend (S3 bucket distributed with CloudFront), and a backend (node.js app inside Elastic Beanstalk).
For the CloudFront part, I created an SSL certificate in N. Virginia (apparently I don't have a choice here) and I made the binding in the CloudFront distribution. It works and my app is served over HTTPS.
For the Elastic Beanstalk part, I created an SSL certificate in Ireland (where my EBS app is hosted) and I bound this certificate to the EBS load balancer using the port 443. It works and I can reach my server with HTTPS using Postman.
However, when my frontend tries to make an API call to the backend I get this error :
I guess I made a mistake while creating the certificates, but I cannot find it. I gave both certificates the same set of CNAMES, I am not sure if I am supposed to do that.
EDIT :
I get the exact same error after updating the frontend so that it points the DName of the load balancer (also mapped to subdomain with Route 53).
CloudFront is attempting to load an HTTPS URL from your load balancer. I assume you have an SSL certification assigned to the load balancer. The domain name of the SSL certificate on the load balancer needs to match the domain name that CloudFront is requesting.
For example if the load balancer's SSL certificate is something like beanstalk.mydomain.com then CloudFront would need to be making requests for https://beanstalk.mydomain.com. The error CloudFront is giving you says that the domain name of the SSL certificate served by the load balancer does not match the domain name djumbo-back-debug.eu-west-1.elasticbeanstalk.co.
You need to setup something like the following:
DNS Name www.mydomain.com points to CloudFront Distribution
Configured to serve www.mydomain.com
Configured with an SSL certificate for the domain www.mydomain.com
Configure to pull from the origin beanstalk.mydomain.com
DNS Name beanstalk.mydomain.com points to Elastic Beanstalk application
With a Load Balancer, with an SSL certificate for beanstalk.mydomain.com