Secure S3 Website Using CDN (CloudFront): Deployment Steps

Home Page

The steps for setting up this secure website on AWS content delivery network (CloudFront) are as follows:

  1. Create some website content (e.g., these wesbite pages you are browsing).

  2. Register a domain name in Amazon Route 53: waltdoescloud.com.

  3. Create two S3 buckets for this 1 website: (a) bucket1 for the website name without www. prefix; (b) bucket2 for website name with www.
    Explanation: bucket2 will contain the actual content and bucket1 will be setup to redirect to bucket2 when clients use the simpler.
        Note: you can do it in reverse - have bucket2 setup to redirect to bucket1 (with the website content being put into bucket1). The effect is the same.

    1. Create s3 bucket waltdoescloud.com with defaults (modifications to come later).

    2. Create s3 bucket www.waltdoescloud.com with defaults (modifications to come later).

  4. Upload website content into s3 bucket www.waltdoescloud.com.

  5. Enable public settings (Permissions) for the s3 bucket www.waltdoescloud.com: edit and disable (un-check) "Block all public access".

  6. Edit the "Bucket policy" to enable public read access to bucket's content: copy-paste contents of bucketpolicy-readonly.txt into the Edit statement text area.

  7. Enable "Static website hosting" setting (bucket's Properties). Options:

    1. Static website hosting: Enabled.

    2. Hosting type: Host a static website.

    3. Index document: index.html.

    4. Error document - optional: error.html.

  8. Setup redirection of non-www bucket (waltdoescloud.com) to www bucket (www.waltdoescloud.com) - now containing website content and configured for static website hosting: in Properties of waltdoescloud.com, set options:

    1. Static website hosting: Enabled.

    2. Hosting type: Redirect requests for an object.

    3. Host name: www.waltdoescloud.com.

    4. Protocol: http (https to be configured later).

  9. Create DNS records (using Route 53) for the two s3 buckets (waltdoescloud.com and www.waltdoescloud.com):

    1. In Route 53 console's "Hosted zones" blade/section, open waltdoescloud.com, create a "Simple Routing" www "A" record:
      1. Record name: www
      2. Record type: "A - routes traffic to an IPv4 address and some AWS resources"
      3. Value/Route traffic to: "Alias to S3 endpoint"
      4. Choose region: whichever region the bucket is set up in.
      5. Choose S3 bucket: only buckets in the region chosen will appear here. Mine: "s3-website-us-east-1.amazonaws.com (www.waltdoescloud.com)".
      6. Evaluate target health: "no" (This option only relevant if website being hosted by a server).

    2. Define another simple record with its "record name" blank, and the same choices for 2nd to 4th options. The last option displays the non-www S3 bucket. Mine: "s3-website-us-east-1.amazonaws.com (waltdoescloud.com)". Again, set "Evaluate target health" to "no".

  10. Secure the website with certificate:

    1. In AWS Certificate Manager, "Request a public certificate" for www.waltdoescloud.com (in the "Domain name" field), and specify "waltdoescloud.com" for the "Add another name to this certificate" field.

    2. Use defaults for "Validation method" (DNS validation) and Key algorithm (RSA 2048).

    3. Validate the DNS records that will use the certificate: open the relevant certificate from ACM's "List certificates" blade, then click "Create records in Route 53" (right pane).

    4. Verify the certificate status has changed from "Pending" to "Issued"

  11. Setup CloudFront for caching and so https can be enabled for the site:

    1. In CloudFront's "Create Distribution" wizard, setup "Origin domain" using the "Bucket website endpoint" URL (for each bucket, in turn): in bucket's Properties - "Static website hosting" section.
      Origin domains: http://www.waltdoescloud.com.s3-website-us-east-1.amazonaws.com and http://waltdoescloud.com.s3-website-us-east-1.amazonaws.com

    2. In the "Default cache behavior" section, set "Viewer protocol policy" to "Redirect HTTP to HTTPS"

    3. For "Alternate Domain Names (CNAMEs), type www.waltdoescloud.com and waltdoescloud.com on separate turns.

    4. For "Price class", select your preference. Mine: Use only North America and Europe.

    5. For "Custom SSL Certficate", select relevant certificate (www.waltdoescloud.com)

    6. For "Supported HTTP versions", include HTTP/3 (HTTP/2 is checked by default).

  12. Enable HTTPS Redirect for the non-www version of the website: In waltdoescloud.com's Properties, "Static web hosting" settings, change the "Protocol" setting to "https".
        NOTE: This setting is not available for www version because the www version is not a redirector site (instead, it's a content hosting bucket).

  13. Change DNS A records (in Route 53) to point to the CloudFront distributions instead of directly pointing at S3:
        Remember: The CloudFront distributions have been configured to point directly to S3 (as "Origin domains").

    1. In the Hosted zone "waltdoescloud.com" check the "www.waltdoescloud.com" record edit it to change "Route traffic to" option from "Alias to S3 website endpoint" to "Alias to CloudFront distribution".

    2. Copy the "Domain name" of the www.waltdoescloud.com Distribution and paste it into the third field of the "Route traffic to" setting located in the "Edit record" dialog box of the www.waltdoescloud.com A record.

    3. Repeat steps a and b for the "waltdoescloud.com" record.

  14. [IMPORTANT TIP] To update cached content immediately, execute an "Invalidation":

    1. Upload your new content to S3.

    2. In CloudFront's "Distribution" blade, select the www.waltdoescloud.com distribution, then run "Create invalidation" on the "Invalidations" tab. You must specify "/**/*" (no quotes) in the Object Paths field.

    3. Repeat for the waltdoescloud.com distribution.

     

References

HOME