CODEWITHSUNDEEP
amazon-s3amazon-cloudfront
Malice
Malice

Reputation: 1482

Configuring Different Error Pages for different origins for the same Cloudfront distributions

We created a cloudfront distribution with 2 origins (1 s3 origin and 1 custom origin). We want the errors(5xx/4xx) from the custom origin to reach the client/user without modification but the error pages from s3 be served by cloudfront error pages configuration. Is this possible ? Currently Cloudfront does not support different custom error pages for different origin - if either of the origin returns an error, the same error page is served by cloudfront.

Upvotes: 5

Views: 2239

Answers (2)

Mike Dalrymple
Mike Dalrymple

Reputation: 1111

I solved (and... ultimately abandoned my solution to) this problem by switching my S3 bucket to act as a static website that I use as a CloudFront custom origin (i.e. no Origin Access Identity). I used an aws:Referer bucket policy to restrict access to only requests that were coming through CloudFront.

NOTE A Referer header usually contains the request's URL. In this scenario, you are just overriding it with a unique, secret token that you share between CloudFront and S3.

This is described on this AWS Knowledge center page under "Using a website endpoint as the origin, with access restricted by a Referer header".

I eventually used a random UUID as my token and set that in my CloudFront Origin configuration. cloudfront origin custom header configuration

With that same UUID, I ended up with a Bucket Policy like:

{
  "Id": "Policy1603604021476",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1603604014855",
      "Principal": "*",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::example/*",
      "Condition": {
        "StringEquals": {
          "aws:Referer": "b4355bde-9c68-4410-83cf-058540d83491"
        }
      }
    },
    {
      "Sid": "Stmt1603604014855",
      "Principal": "*",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::example",
      "Condition": {
        "StringEquals": {
          "aws:Referer": "b4355bde-9c68-4410-83cf-058540d83491"
        }
      }
    }
  ]
}

The s3:ListBucket policy is needed to get 404s to work properly. If that isn't in place, you'll get the standard S3 AccessDenied error pages.

Now each of my S3 Origins can have different error page behaviors that are configured on the S3 side of things (rather than in CloudFront).

Follow Up I don't recommend this approach for the following reasons:

  1. It is not possible to have S3 host your static website on HTTPS so your Referer token will be sent in the clear. Granted this will likely be on the AWS network but it's still not what I was hoping for.
  2. You only get one error document per S3 Bucket anyway so it's not that big of an improvement over the CloudFront behavior.

Upvotes: 0

jogold
jogold

Reputation: 7417

You can customize the error responses for your origins using Lambda@Edge.

You will need to associate an origin-response trigger to the behavior associated with your origin.

The origin-response is triggered after CloudFront receives the response from the origin:

enter image description here

This way you can add headers, issue redirects, dynamically generate a response or change the HTTP status code.

Depending on your use case, you may have to customize for both origins.

See also Lambda@Edge now Allows you to Customize Error responses From Your Origin.

Upvotes: 2

Related Questions