I am unable to access S3 objects and Bucket via cloud front URL.
I have created CLOUDFRONT Distribution ( Web ) and setup origin path to media folder in my S3 bucket. ( /media)
CF url is pointing to bucket/media , but i am unable to access it from my web application as well as browser.
I am trying to access like below:
http://d1xdpXXXXX.cloudfront.net/media/images/Tiger.jpg
Tiger.jpg can be accessed via s3 url.
I also tried http://d1xdpXXXXX.cloudfront.net but i am getting below error:
<Error>
<Code>NoSuchBucket</Code>
<Message>The specified bucket does not exist</Message>
<BucketName>d1xdpwiqgrffrd.cloudfront.net</BucketName>
<RequestId>484BBB2F7907172F</RequestId>
<HostId>+bLr4Qx+uawbq4YNIOuKGCQVDGQQQsifGnNt9J5Pn+r3mqbDiVYcpNZRUfnCyPnHxewfMVp3QYc=</HostId>
</Error>
Please help.
CF Distribution settings
Access denied error
You have already added the path in cloudfront origin.
So, you don't have to add that in cloudfront url you are using to download.
Just use
http://d1xdpXXXXX.cloudfront.net/images/Tiger.jpg
as /media is already part of the distribution.
Related
I've a CF distribution with 2 origins:
S3
ALB
This distribution has an alternate CNAME.
Depending on the path, I want some files being served by S3, other by the ALB.
I've 3 behaviours with the following paths:
assets/* with S3 as origin
uploads/* with the alb as origin
default with the same uploads/*'s origin but with a different cache policy
In the S3 bucket there are 2 folders: svg and v2
when I try
curl -I https://myalternate.domain.name/assets/svg/mysvg.svg or
curl -I https://xxxxxx.cloudfront.net/assets/svg/mysvg.svg
I've 404.
If I get them from web I can see
<Error>
<Code>NoSuchBucket</Code>
<Message>The specified bucket does not exist</Message>
<BucketName>myalternate.domain.name or cloudfront endpoint</BucketName>
<RequestId>Q7Z1NAP8HV0PCEM4</RequestId>
</Error>
For the other paths everything is alright.
What did I miss?
What the CloudFront does when it receives the https://myalternate.domain.name/assets/svg/mysvg.svg request is that it will fetch the object stored in S3 using the key assets/svg/mysvg.svg. That's why it returns 404 since the actual key of that object is svg/mysvg.svg. The solution is to either add assets/ prefix to every object in S3 or use a Lambda#Edge function to rewrite the origin request.
So I have an AWS S3 Bucket hosting the files for a react application I've built. I use CodePipeline to build and compile the React app and store the files on an S3 bucket which is served through a CloudFront CDN.
Everything seems to be working fine when I access the url from the root https://website.com. When I click "login" on that page I get directed to the following route https://website.com/auth/login and it works awesome.
The Problem
If I try to access the page https://website.com/auth/login directly I get the following error:
<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>66CE67E2E5DA0B7B</RequestId>
<HostId>Spfhgnlygx05eugycEy5ew4e8oSn/ccNX21Iy/6qaAxI8glXljDjgKmUPvMzRd8+NktQsNietpg=</HostId>
</Error>
I set the default resource in the cloudfront CDN to the /index.html which is why the root domain works, but how do I get all there urls to point to /index.html so the app routes it properly?
I needed to set a rule for 403 Forbidden in my cloudfront configuration as posted here: Receive AccessDenied when trying to access a reload or refresh or one in new tab in angular 5
I'm working on getting a static website deployed with AWS Codebuild, hosted in an S3 bucket, and accessed via Cloudfront. Everything seems to work except from accessing from Cloudfront. From Cloudfront, I can access files that I manually upload, and using the bucket URL, I can access all the files. Looking through the individual file settings/permissions, they all look to be the same, regardless of whether they were manually uploaded, or deployed via Codebuild. I've tried invalidating the Cloudfront cache, and re-deployed via Codebuild several times.
Additional Information:
I provided the S3 bucket as an origin when setting up the Cloudfront distribution.
Accessing via Cloudfront gives the following error:
<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>0211CBE618946F</RequestId>
<HostId>
7sRZhaJS4x2W7Iaeo4y8KAjvsOJcNWh3PxCdgnhXPE22oyp1RxZhwpjrqbsWapsUSaqBK+jqE=
</HostId>
</Error>
What else should I check?
For some reason, adding a default root object fixed the issue.
FWIW, I initially changed the value to dist/index.html, which allowed me to access the deployed bucket contents via the Cloudfront URL, but required the index.html suffix. Once I changed it to index.html, everything worked fine.
Following is what I'm doing. I'm generating a pre-signed URL using a custom domain for my s3 bucket resources which are not public.
https://files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX
Also to add the certificate I've created a cloudfront distribution for the bucket having following origin settings
Origin Domain Name: bucket-name.s3.amazonaws.com
Origin Id : s3.bucket-name
Restrict Bucket Access: No
Yet I'm unable to access my resources. Throws access denied error. Any help would be appreciated.
There are two cases:
If your bucket has regular name.
In this case you should use CloudFront to access your bucket.
And like mentioned above URL looks like in this answer:
https://cloudfront-url/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX
If your bucket has s3 static website name.
In this case your bucket name looks like files.customdomain.com and you can generate pre-signed url for this bucket:
https://files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX
In your DNS you will have CNAME files.customdomain.com points to files.customdomain.com.s3.[bucket-region].amazonaws.com.
NOTICE
When I generate pre-signed URL via aws-cli:
aws s3 presign s3://files.customdomain.com/file123 --endpoint-url https://files.customdomain.com
I get URL with duplicate bucket name in the path:
https://files.customdomain.com/files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX
instead of:
https://files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX
I don't know if it has the same behavior via SDK.
Have you tried initializing S3 with the custom url var S3 = new AWS.S3({endpoint: 'media.domain.com', s3BucketEndpoint: true});
More info https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/S3.html
Also, make sure signature is correct as well https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingAWSSDK.html#specify-signature-version
Ref : https://github.com/aws/aws-sdk-js/issues/891
When using S3 with CloudFront, you don't want an S3 signed URL... you want a CloudFront signed URL.
Read Configuring Security and Limiting Access to Content in the CloudFront developer guide.
I found a solution for this question. The signed url needs to be generated for cloudfront url endpoint from s3 bucket. Therefore instead of
https://files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX
it needs to be
https://cloudfront-url/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX
and DNS records had to resolve custom domain to cloudfront url.
I've set up an example static website on Amazon S3 and I added a custom folder to it with file inside: custom-folder/index.html, but
I'm getting Access Denied error when trying to access url /custom-folder.
The index document is configured to be index.html, so S3 should serve index.html when I'm accessing /custom-folder url, but it doesn't work.
How can I fix this?
It seems you are using the wrong URL to access the bucket.
For example, when you enable to static website hosting feature in S3 (us-west-2 in this example), you are given a URL with the following format:
Endpoint : http://bucket-name.s3-website-us-west-2.amazonaws.com
You can see your endpoint by going to S3 > Click on your bucket > Bucket Properties > Static website hosting > should reveal your endpoint.
In case it helps anyone else, I was using a AWS Cloudfront Distribution on top of an S3 bucket.
The solution to the "Access Denied" issue for me was to perform the / to /index.html redirect in Cloudfront (rather than S3).
This is achieved by setting the "Default Root Object" to index.html on the AWS Cloudfront Distribution (and disabling "Static website hosting" entirely in S3).