How to use CloudFront and S3 with alternate domain?

1
votes

Let's say I have an S3 bucket named example.com and I want to serve its content through CloudFront using an alternate domain example.com.

I've added a CNAME record to direct example.com to the CloudFront endpoint, and secured the domain using an AWS SSL Certificate.

In CloudFront, when I go to select the Origin, it shows my bucket. For example: example.com.s3.amazonaws.com

If I choose this origin, and I browse to https://example.com/my-bucket-item.jpg, I get redirected to https://example.com.s3-us-east-2.amazonaws.com/my-bucket-item.jpg and a "Connection not secure" SSL error appears.

If I set the origin to just the domain example.com then I get a 403 Bad Request error from CloudFront.

From what I understand, my bucket has to share the name of my domain, otherwise I get a "bucket does not exist" error.

I've followed the AWS documentation on this. What I'm doing wrong here?

Update

I successfully got CloudFront to recognize my alternate domain by changing my origin policy to Managed-CORS-S3Origin.

New problem: even though I've selected 'Yes' to 'Restrict Bucket Access', I'm still able to access files via the S3 url. Do I need to turn off public access to my bucket? If I do this, it seems to override my CloudFront policy...

1
amazon-s3amazon-cloudfrontcname
What is the domain configuration in the AWS SSL Certificate ? – Michael Desigaud
@MichaelDesigaud domain example.com with configuration status 'Success' and certificate status 'Issued'. Associated resource is my CloudFront distribution. – HWD
@HWD use an Origin Access Identity and restrict your AWS S3 to only be accessed by Cloud Front: docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/… – Nagaraj Tantri

1 Answers

0
votes

I had to change my origin request policy to Managed-CORS-S3Origin - this solved the general problem for me.