Can we connect a Non-Public s3 bucket sitting on AWS Gov Cloud to a cloudfront distribution on a non gov cloud AWS account. There is not much docs or steps given anywhere.
We did try connecting it with Canonical Account ID, Cloudfront Origin in the s3 bucket policy. But nothing has worked so far.
Is this not possible or is there a way to achieve this?
Edit:
I ask this because there is a section of AWS docs talks about tips on having gov-cloud s3 content on cloudfront. But it has no details on how to do it.
Link: https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/setting-up-cloudfront-tips.html
It is hard to see how that would be possible.
AWS GovCloud regions are physically isolated, including logical network isolation from all other AWS regions, except for very specific service endpoints.
Here is another solution, provided in the official AWS documentation:
https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-serve-static-website/
For Origin Custom Headers, under Header Name, enter Referer. Under Value, enter a custom header that you want to forward to the origin (S3 bucket). To restrict access to the origin, you can enter a random or secret value that only you know.
Basically, Cloudfront will use a custom header containing a secret value, your S3 bucket on govcloud will be public read access with a custom policy to allow only this secret value in the header.
Don't forget to force HTTPS between cloudfront and your govcloud s3 bucket with OriginProtocolPolicy https-only set.
Related
I need to quickly deploy a static angular app to AWS S3. Unfortunately, I am still new to id so I would like to ask your help on:
What should be the bucket policy?
What roles should I give a user group to access it?
Requirements:
App deployed in the S3 bucket is public
Bucket contents should only accessible by those part of a user group. The users of the group should only be able to upload and get files in the bucket. Nothing more nothing less.
Another user group as administrators of the bucket.
Thanks. Any help would be appreciated.
Have you read Hosting a static website using S3? That should answer your question about bucket policy.
IAM users will need the appropriate S3 permissions on the bucket. This is an example of a read-write policy; remove the s3:PutObject and s3:DeleteObject permissions for read-only access.
As luk2302 pointed out, if you want to publish the S3 URL as your website URL, then the bucket contents must be publicly readable. If you want to publish the app using a custom domain name and/or use HTTPS, you should consider adding a CloudFront distribution. Doing so would also allow you to keep the bucket contents private so only your IAM users have direct access to the bucket.
I followed a really really simple manual to create S3 bucket and put CloudFront in front of it.
See here [1]. If I create the S3 bucket in us-east-1 everything is working as expected: After I uploaded a file, I can see it via e.g. xyz.cloudfront.net/myExampleFile.txt link.
But when I create the S3 bucket in e.g. eu-west-1 or eu-central-1, then as soon as I open the xyz.cloudfront.net/myExampleFile.txt link, my browser gets redirected to the direct S3 bucket link xyz.s3.amazonaws.com/myExampleFile.txt which of course is not working.
--
I have no clue what I could be possibly doing wrong... And due to the fact, that I am not able to submit any support request to AWS directly ("Technical support is unavailable under Basic Support Plan"), I thought I might ask the community here, if anybody else experience the same strange behavior or has any hints, what is going wrong here?
Thank you in advance for any help
Phenix
[1] Step 1,2 and 4 under Using a REST API endpoint as the origin, with access restricted by an OAI on https://aws.amazon.com/de/premiumsupport/knowledge-center/cloudfront-serve-static-website/
You are probably encountering the issue described here.
If you're using an Amazon CloudFront distribution with an Amazon S3 origin, CloudFront forwards requests to the default S3 endpoint (s3.amazonaws.com), which is in the us-east-1 Region. If you must access Amazon S3 within the first 24 hours of creating the bucket, you can change the Origin Domain Name of the distribution to include the regional endpoint of the bucket. For example, if the bucket is in us-west-2, you can change the Origin Domain Name from bucketname.s3.amazonaws.com to bucketname.s3-us-west-2.amazonaws.com.
I want to connect CDN to an AWS S3 Bucket, but the AWS Document indicates that the bucket name must be the same as the CNAME. Therefore, it is very easy to guess the real s3 bucket url by others.
For example,
- My domain: example.com
- My S3 Bucket name: image.example.com
- My CDN CNAME(image.example.com) will point to image.example.com.s3.amazonaws.com
After that, people can access the CDN URL -> http://image.example.com to obtain the resources from my S3 Bucket. However, under this restriction, people can guess my real S3 bucket url from the CNAME (CNAME + s3.amazonaws.com) easily.
So, my question is that how can I hide my real s3 bucket url? Because I don't want to expose my real S3 url to anyone for preventing any attacks.
I am not sure I understand what you are asking for or what you are trying to do [hiding your bucket does not really help anything], however I will attempt to answer your question regarding "hiding" your bucket name. Before I answer, I would like to ask these two questions:
Why do you want to hide your S3 bucket url?
What kind of attacks are you trying to prevent?
You are correct that the S3 bucket name had to be the same as your URL. This is no longer a requirement as you can mask the S3 bucket using cloudfront. CloudFront as you know is a CDN from AWS. Thus the bucket name could be anything (randomstring).
You can restrict access to the bucket, such that only CloudFront can access it. Data in the bucket is then replicated to edge locations and served from there. Even if one knows the S3 URL, it will not do anything as access to the s3 bucket is restricted, an IAM rule grants CloudFront access and no one else.
Access restriction is done via origin access and while you can manually configure this using a bucket policy, you can also set a flag in CloudFront to do this on your behalf. More information is available here.
Use the CloudFront name in Route53. Do not use CNAME, but rather use A type, and set it up as an Alias. For more information see this document.
If you are using a different DNS provider, AWS aliases will naturally not be available. I suggest moving the zone file from your other provider to AWS. If you cannot do this, then you can still use a CNAME. Again see here for more information.
I suggest using your own domain name for CloudFront and setting up HTTPS. AWS offers certificates at no additional cost for services within AWS. You can register a certificate for your domain name which is either validated by a DNS entry or an Email. To set this up please see this document.
If you want to restrict access to specific files within AWS, you can use signed URLs. More information about that is provided here.
Can we set weighted policy on s3, if yes. What is the step by step process.
I tried that and have a problem that traffic is routed to one endpoint only.
I done research on that and found might it is a problem with CNAME mentioned in cloudfront.
Please suggest correct values also for that.
S3 objects are only stored in a single region, meaning that in order to access that particular object, you must go through that regions API Endpoint.
For example, if you had "image.jpg" stored in a bucket "s3-images", that was created in the eu-west-1 region - in order to download that file you must go through the appropiate S3 Endpoint for the eu-west-1 Region:
s3-eu-west-1.amazonaws.com
If you tried to use another Endpoint, you will get an error, pointing out that you are using the wrong endpoint
If your question is relating to using CloudFront in front of S3, you need to set your DNS CNAME to resolve to your CloudFront Distributions CNAME in order for your users to be routed through CloudFront, rather than hitting S3 directly:
[cdn.example.com] -CNAME-> [d12345.cloudfront.net] -> s3://some-bucket
Say you want to host a static web site on S3 :
You create a bucket with name your-website.com and set it up for web hosting;
You add a CNAME in your domain's zone file to point to your S3 bucket.
Great. Everything works fine when you visit http://your-website.com. But you don't want the raw/"naked" endpoint to be accessible.
Is there any setting in the bucket to disable direct access to http://your-website.com.s3-website.your-region.amazonaws.com ?
The reason is that if your web site is accessible both through http://your-website.com and http://your-website.com.s3-website.your-region.amazonaws.com would hurt your SEO (duplicate content)
You mention your major concern is SEO. For that purpose, you could use a other techniques, that are probably easier to implement than the one you initially asked about.
One of the main techniques to deal with duplicate content is to use rel=canonical, which is probably fairly easy to implement. For more information, see http://googlewebmastercentral.blogspot.com.br/2013/04/5-common-mistakes-with-relcanonical.html
If you insist on the need to disable access to the bucket unless the client connects through your CNAME, your best bet is to use CloudFront. You disable the S3 website hosting option on your bucket, make your S3 bucket private (i.e., remove bucket policies or ACLs allowing public read), create a CloudFront distribution, define your bucket as the origin, configure a CNAME on your distribution, change your DNS records to point to your distribution instead of bucket, create an Origin Access Identity (OAI) on your distribution and grant access to your bucket for that OAI. Phew.
By doing all this, there's no way for a user to access the content on your S3 bucket (unless they have an AK/SK with permissions to read the bucket, and send a signed request, obviously). The only way will be through your domain.
For more detail on Origin Access Identity, see http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html