4 ms·

I have set up some sites the same way, the only ugly part for me was that I wanted to use the features of S3 web hosting interface, but restrict all traffic to

I have set up some sites the same way, the only ugly part for me was that I wanted to use the features of S3 web hosting interface, but restrict all traffic to come through CloudFront. This blog post (not mine) describes the problem and the approach: https://abridge2devnull.com/posts/2018/01/restricting-access-to-a-cloudfront-s3-website-origin/ https://abridge2devnull.com/posts/2018/01/restricting-access...

edaemon 8y ago
Just wondering, what's the motivation to restrict access? Is it to keep costs down in case someone decides to run up your bill with a flurry of requests?
- PowerfulWizard 8y ago
  Just so the CloudFront logs and monitoring are complete. It won't affect the hosting cost as far as I know, I just use billing alerts on the overall account to keep track of that.
zackbloom 8y ago
Have you thought about using Cloudflare Workers instead? It's pretty easy to host from a bucket: https://developers.cloudflare.com/workers/recipes/static-site/ https://developers.cloudflare.com/workers/recipes/static-sit...
- PowerfulWizard 8y ago
  I wanted to stay fully AWS, it was for personal projects so it is more about convenience so I didn't even consider other CDNs.
qrohlf 8y ago
there's actually a way to do this with OAI, you just have to configure the html5 routing stuff using CloudFront distribution rules instead of configuring the S3 bucket as a static website. As a nice side effect, you can also enforce https<>https<>https communication all the way through the S3<>Cloudfront<>world chain, which isn't possible to force when the S3 bucket is configured for static site hosting. I have about 75% of a blog post about how to do this, it's not terribly complicated. This comment just gave me the motivation to finish it, I'll post it on HN when it's ready.
- PowerfulWizard 8y ago
  yeah, I tried to do that or something similar first, IIRC the s3 website setup was handling the index document and error document stuff, but using cloudfront to fetch through the S3 API wasn't doing that so that is how I ended up where I ended up.

edaemon 8y ago

Just wondering, what's the motivation to restrict access? Is it to keep costs down in case someone decides to run up your bill with a flurry of requests?

PowerfulWizard 8y ago
Just so the CloudFront logs and monitoring are complete. It won't affect the hosting cost as far as I know, I just use billing alerts on the overall account to keep track of that.

zackbloom 8y ago

Have you thought about using Cloudflare Workers instead? It's pretty easy to host from a bucket: https://developers.cloudflare.com/workers/recipes/static-site/ https://developers.cloudflare.com/workers/recipes/static-sit...

PowerfulWizard 8y ago
I wanted to stay fully AWS, it was for personal projects so it is more about convenience so I didn't even consider other CDNs.

qrohlf 8y ago

there's actually a way to do this with OAI, you just have to configure the html5 routing stuff using CloudFront distribution rules instead of configuring the S3 bucket as a static website. As a nice side effect, you can also enforce https<>https<>https communication all the way through the S3<>Cloudfront<>world chain, which isn't possible to force when the S3 bucket is configured for static site hosting. I have about 75% of a blog post about how to do this, it's not terribly complicated. This comment just gave me the motivation to finish it, I'll post it on HN when it's ready.

PowerfulWizard 8y ago
yeah, I tried to do that or something similar first, IIRC the s3 website setup was handling the index document and error document stuff, but using cloudfront to fetch through the S3 API wasn't doing that so that is how I ended up where I ended up.