3 ms·
I set up a few websites for side projects that use Cloudfront + a public S3 bucket + Lambda for the backend when needed. It's extremely fire and forget web host
by Pfhreak 6y ago
I set up a few websites for side projects that use Cloudfront + a public S3 bucket + Lambda for the backend when needed. It's extremely fire and forget web hosting for simple static sites and I think it costs me basically nothing.
How do you enable S3 for my use case (where I am ok with all the assets being public because they are all static JS/HTML/CSS/images) but also prevent breaches like this?
- toomuchtodo 6y ago> How do you enable S3 for my use case (where I am ok with all the assets being public because they are all static JS/HTML/CSS/images) but also prevent breaches like this? Do not put anything you don’t want to be public in your S3 bucket. Also, best practice would be for the bucket to be private but Cloudfront be authorized to access the objects to retrieve from the S3 origin and cache at the edge. Use a separate S3 bucket for sensitive data. Use lifecycle rules to delete objects as soon as feasible so you’re not storing sensitive data for longer than you need to. Ensure that cloudtrail logs and s3 logging is enabled for sensitive buckets, so you have access logs for forensics if you do unintentionally leak objects with sensitive data.
- Pfhreak 6y agoOh, sorry, yeah I'm aware of these things. I'm trying to square the circle where the parent suggested that maybe there shouldn't be public buckets. (And maybe that's actually true... maybe to serve from them you should be required to figure out Cloudfront.)