AWS Get Pre-Signed URL with custom domain

Question

Following is what I'm doing. I'm generating a pre-signed URL using a custom domain for my s3 bucket resources which are not public.

https://files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX

Also to add the certificate I've created a cloudfront distribution for the bucket having following origin settings

Origin Domain Name: bucket-name.s3.amazonaws.com Origin Id : s3.bucket-name Restrict Bucket Access: No

Yet I'm unable to access my resources. Throws access denied error. Any help would be appreciated.

Answer 1

There are two cases:

1. If your bucket has regular name.

In this case you should use CloudFront to access your bucket. And like mentioned above URL looks like in this answer:

https://cloudfront-url/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX

2. If your bucket has s3 static website name.

In this case your bucket name looks like files.customdomain.com and you can generate pre-signed url for this bucket:

https://files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX

In your DNS you will have CNAME files.customdomain.com points to files.customdomain.com.s3.[bucket-region].amazonaws.com.

NOTICE

When I generate pre-signed URL via aws-cli:

aws s3 presign s3://files.customdomain.com/file123 --endpoint-url https://files.customdomain.com

I get URL with duplicate bucket name in the path: https://files.customdomain.com/files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX

instead of:

https://files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX

I don't know if it has the same behavior via SDK.

Answer 2

Have you tried initializing S3 with the custom url var S3 = new AWS.S3({endpoint: 'media.domain.com', s3BucketEndpoint: true}); More info https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/S3.html Also, make sure signature is correct as well https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingAWSSDK.html#specify-signature-version Ref : https://github.com/aws/aws-sdk-js/issues/891

Answer 3

I found a solution for this question. The signed url needs to be generated for cloudfront url endpoint from s3 bucket. Therefore instead of
https://files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX
it needs to be
https://cloudfront-url/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX

and DNS records had to resolve custom domain to cloudfront url.

Answer 4

When using S3 with CloudFront, you don't want an S3 signed URL... you want a CloudFront signed URL.

Read Configuring Security and Limiting Access to Content in the CloudFront developer guide.