AWS Get Pre-Signed URL with custom domain

Question

Following is what I'm doing. I'm generating a pre-signed URL using a custom domain for my s3 bucket resources which are not public.

Also to add the certificate I've created a cloudfront distribution for the bucket having following origin settings

Origin Domain Name: bucket-name.s3.amazonaws.com Origin Id : s3.bucket-name Restrict Bucket Access: No

Yet I'm unable to access my resources. Throws access denied error. Any help would be appreciated.

score 8 · Answer 1 · answered Feb 22 '21 at 13:11

There are two cases:

In this case you should use CloudFront to access your bucket. And like mentioned above URL looks like in this answer:

https://cloudfront-url/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX

In this case your bucket name looks like files.customdomain.com and you can generate pre-signed url for this bucket:

In your DNS you will have CNAME files.customdomain.com points to files.customdomain.com.s3.[bucket-region].amazonaws.com.

NOTICE

When I generate pre-signed URL via aws-cli:

aws s3 presign s3://files.customdomain.com/file123 --endpoint-url https://files.customdomain.com

instead of:

I don't know if it has the same behavior via SDK.

score 4 · Answer 2 · edited Jun 18 '19 at 21:22

4

edited Jun 18 '19 at 21:22

Yves M.

answered Nov 03 '18 at 05:24

score 3 · Answer 3 · answered Nov 03 '18 at 13:50

3

When using S3 with CloudFront, you don't want an S3 signed URL... you want a CloudFront signed URL.

answered Nov 03 '18 at 13:50

Michael - sqlbot

No I need a s3 signed URL as I've added in the question. But as the custom end point i had to provide cloudfront url. Thanks for your help that gave me a hint. – Yohan Nov 03 '18 at 15:47

score 2 · Accepted Answer · answered Nov 03 '18 at 15:51

2

and DNS records had to resolve custom domain to cloudfront url.

answered Nov 03 '18 at 15:51

Yohan

3

This works, mostly by accident, but it will "work" as long as you understand a couple of important limitations: (1) it only works if the bucket is in one of the older (pre-2014) AWS regions like Ireland & Virginia, not newer regions like London & Ohio... and (2) all of your requests will be cache misses unless the *identical* signed URL (same key, expires, and signature) is reused by multiple clients. CloudFront can't allow different S3 signed URLs to be served from cache because it can't verify the authentication, so it has to forward every unique URL all the way back to S3 when first used. – Michael - sqlbot Nov 03 '18 at 16:25
I see. really thanks for the info. The solution I was looking for is something as above in my specific scenario. But your way is the most accurate way as it seems. Thanks again. – Yohan Nov 03 '18 at 17:33

4 Answers4