I want to use my domain link to access s3 objects instead of s3 object link

Question

I'm working on a OTA update, my requirement is that I need a domain link from where the iot device will fetch the update file (which will be stored in s3) , how do I link the s3 bucket through the domain link ( can't use the s3 bucket link directly due to Iot device connstraints) ?

Answer 1

If you need a custom domain to serve files from an S3 bucket, you can use Amazon CloudFront in conjunction with Amazon Route 53 to achieve this. Here's a step-by-step process:

1. Create an S3 Bucket:

   • Create an S3 bucket where you'll store your OTA update files.
   • Make sure your files in the S3 bucket are publicly readable (or set appropriate bucket policies) so CloudFront can access them.

2. Create a CloudFront Distribution:

   • Open the CloudFront console and create a new distribution.
   • For the origin, select your S3 bucket.
   • Ensure the distribution is set to "Use All Edge Locations (Best Performance)".
   • Take note of the distribution domain name (e.g., d12345abcdwq.cloudfront.net).

3. Set Up SSL:

   • To use HTTPS with your custom domain, request or import an SSL certificate in the AWS Certificate Manager (ACM).
   • Once validated, assign this certificate to your CloudFront distribution in the "SSL Certificate" section.

4. Configure Route 53:

   • Purchase a domain using Route 53 or transfer an existing domain.
   • Create a new "A" record set in your domain's hosted zone.
   • Set the alias target to your CloudFront distribution domain name (from step 2).
   • Now, your custom domain will point to the CloudFront distribution, which in turn fetches files from your S3 bucket.

5. Access Files Using Custom Domain:

   • After setting up the above, you can access the files in your S3 bucket using your custom domain. For example, if your custom domain is updates.mydomain.com, and you have a file named update.bin in your S3 bucket, you can access it at https://updates.mydomain.com/update.bin.

6. Restrict Direct S3 Bucket Access (Optional):

   • If you want to ensure that files can only be accessed via CloudFront (and your custom domain) and not directly from the S3 URL, you can update your S3 bucket policy to restrict access only to CloudFront. This can be achieved using the aws:Referer condition in your bucket policy, or by allowing only the CloudFront origin access identity to access the S3 bucket.