CODEWITHSUNDEEP
amazon-web-servicesaws-api-gatewayamazon-route53serverless
Raimondas Kazlauskas
Raimondas Kazlauskas

Reputation: 249

Disable http redirection to https

I'm developing little service using lambda functions which returns "Fact of the day" in your CLI using curl.

First, I developed business logic, deployed and created lambda using Serverless.

Second, I bought domain using aws route 53, Provisioned certificate and routed domain using `Custom Domain Name on API gateway.

At the moment if you would visit https://domain.io service works as intented but if you would try call curl domain.io it outputs:

<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>CloudFront</center>
</body>
</html>

My goal is to get service running without SSL (or redirect), by calling curl domain.io.

Is it possible to avoid redirection? Or can you create API custom domain name without certificate?

Currently I call curl -F domain.io it will follow redirect, but it's not solution I'm looking for.

Thank you!

Upvotes: 2

Views: 2423

Answers (1)

Michael - sqlbot
Michael - sqlbot

Reputation: 178956

Remove the custom domain configuration from API Gateway.

Wait a few minutes for API Gateway to release the custom domain in the AWS Edge Network (there isn't a way to determine when this is complete, but you'll get an error on one of the subsequent steps until it is. 20 minutes should be sufficient).

Create a CloudFront distribution, using the generic ...execute-api...amazonaws.com domain name assigned to your API stage.

For Origin Protocol Policy, select HTTPS Only.

Set the Origin Path to your stage prefix (e.g. /prod or /v1) -- whatever you set up as the stage prefix.

Set the Viewer Protocol Policy to HTTP and HTTPS.

Set the Minimum TTL and Default TTL to 0.

Set the Alternate Domain Name for the distribution to your custom domain.

If you want SSL to optionally work on your custom domain, associate an ACM certificate with the CloudFront distribution.

Change your DNS entry to point to the *.cloudfront.net hostname assigned to your distribution.

Wait for the CloudFront distribution state to change from In Progress to Deployed.

Test.

This seems like a lot of effort to enable HTTP against API Gateway, but it is necessary, because API Gateway was specifically designed not to support HTTP -- it only works with HTTPS, because that's a best-practice for APIs, generally.

Q: Can I create HTTPS endpoints?

Yes, all of the APIs created with Amazon API Gateway expose HTTPS endpoints only. Amazon API Gateway does not support unencrypted (HTTP) endpoints.

https://aws.amazon.com/api-gateway/faqs/

CloudFront is commonly known as a CDN, but it is in fact something of a Swiss Army knife of custom HTTP request manipulation, and this is a case of that.

Once you verify your behavior, you can optionally increase the Default TTL in CloudFront, which will cause it to cache responses for up to that value in seconds, reducing your costs by sending fewer actual requests to API Gateway and replaying cached responses to the callers.

This setup differs from what you have, now, because you are in control of the CloudFront distribution, instead of API Gateway... so you can customize it in ways that API Gateway doesn't allow when it is in control.

Upvotes: 6

Related Questions