1

I've got a domain name foobar-staging.com, that I use for the staging environment to get feedback, testing or demo before releasing to production. Recently, decided to deploy the UI static files to s3 and everything else falling back to ALB. The original setup is only accessible privately, so the user has to connect to a VPN to be able to access foobar-staging.com, and as far as I've tested so far Cloudfront content origins need to be public, so it seems that I won't be able to keep the staging server private, unless someone confirms me otherwise?

What I want to access privately is:

Domain name > Cloudfront > s3 (/routeX, /routeY) or ALB (other routes /*)

The EC2s only have private ips and the ELB security group do not allow public access. I've allowed 80/443 0.0.0.0/16 access to see the Cloudfront work for the setup... I don't necessarily need Cloudfront (other alternative would do, as I can't route to s3 in ALB), but without having Cloudfront in front of s3 and alb, I'd have to access the UI application through the s3 amazon domain, which I'd much prefer to use the foobar-staging.com.

Is it possible to do?

Improve this question
4
  • Did you solve the issue?
    – 030
    Commented Dec 20, 2019 at 11:38
  • Yes, I did. I'll post the solution, but I'm on mobile at the moment traveling.
    – punkbit
    Commented Dec 20, 2019 at 15:17
  • Ok great. Please let me know once you posted an answer.
    – 030
    Commented Dec 20, 2019 at 15:18
  • 1
    @030 I've answered it, as long you understand the concept of what I built, you'll be able to come up with your own solution hopefully. Good luck!
    – punkbit
    Commented Dec 20, 2019 at 15:39

1 Answer 1

Reset to default
1

My solution is based on signed cookies (find how to implement it here, https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-cookies.html); I've created a lambda that handles this for me a bit differently, as I need users to access a location to get their cookie in the easiest way possible and have someone control to whom can be granted the auth cookie. An example of a basic implementation of this is here: https://aws.amazon.com/blogs/compute/simply-serverless-using-aws-lambda-to-expose-custom-cookies-with-api-gateway/

enter image description here

Finally, after you have provided your Content origin in Cloudfront, in the Behaviors tab where you setup the Content origin desired behaviour you need to set "Restrict Viewer Access (Use Signed URLs or Signed Cookies)".

Obs: make sure you also forward all cookies and query strings.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.