4 ms·
This works, but it leaves all traffic between the CloudFront edge node and S3 unencrypted. In theory, that shouldn't be an issue, by why risk it? A better way
by subway 9y ago
This works, but it leaves all traffic between the CloudFront edge node and S3 unencrypted. In theory, that shouldn't be an issue, by why risk it?
A better way is to completely leave the "website" bits of S3 off, and leave that all up to CloudFront. You can create an Origin Access Identity, then grant that OAI access to read your S3 bucket (all automated in the wizard when you create a CF dist and specify an S3 origin). You then specify a default object in your CF dist, and bam, CF is using the S3 REST API over SSL to secure that CF-S3 hop.
- greatamerican 9y agoVery interesting. I'll check this out.
- fishdaemon 9y agoAnother important aspect of using AOI is that you don't need to make the s3 bucket public. This matters even if the website is fully public. It has to do with a simple governance rule. No public s3 buckets should be allowed. That if monitored and enforced would stop many data breaches. With some public bucketd enforcement will be difficult
- justinsaccount 9y agoDefault object only works at the root of the site. Making it work everywhere is quite a bit more complicated https://aws.amazon.com/blogs/compute/implementing-default-directory-indexes-in-amazon-s3-backed-amazon-cloudfront-origins-using-lambdaedge/ https://aws.amazon.com/blogs/compute/implementing-default-di...
- deleted 9y ago[deleted]