5 ms·
> The problem with hosting a site on S3 is there's no way to use TLS. The standard solution for having TLS on sites hosted on S3 is to use CloudFront.
by zokier 6y ago
> The problem with hosting a site on S3 is there's no way to use TLS.
The standard solution for having TLS on sites hosted on S3 is to use CloudFront.
- cs02rm0 6y agoThe standard solution for any issue on AWS is to add another service.
- john-shaffer 6y agoSeparation of concerns: https://en.wikipedia.org/wiki/Separation_of_concerns https://en.wikipedia.org/wiki/Separation_of_concerns I, for one, greatly appreciate having CDN features cleanly separated from object storage. It makes sense, since they are completely different things.
- freehunter 6y agoThe standard solution for any issue on Unix is to pipe the output to another service but very few people complain about POSIX.
- Supermancho 6y agoBecause they aren't incrementally charged for each one in according to an arcane and opaque costing schedule.
- freehunter 6y agoNo, they just pay for the entire server whether they're using it to its full potential or not. Amazon's option is almost always cheaper.
- zelly 6y agoThe UNIX philosophy would call for a service that does one thing well. CloudFront is a CDN among other things and, in this case, a TLS termination proxy. I should be able to stack something onto S3 that just does the latter, because I may not need the costs or the hassle (to invalidate caches) of a CDN. But hey, it's a free county with lots of competition and Netlify and I think Azure lets you do this.
- jmdeon 6y agoIf you load the site again it should be using tls. I opted to separate concerns and threw Cloudflare(free tier) in front of it. You might be wondering, well okay its encrypted between my browser and Cloudflare but what about the connection between the Cloudflare proxy server and s3? To solve that I used the s3 api endpoint instead of the website endpoint which supports tls. I turned Cloudflare's tls setting to full which uses tls between proxy and origin but allows for a self-signed cert from the origin. So its encrypted from browser to proxy to s3 api. As long as no one poisons the s3 api dns we should be good.