156

I am using an Amazon S3 bucket for uploading and downloading of data using my .NET application. Now my question is: I want to access my S3 bucket using SSL. Is it possible to implement SSL for an Amazon s3 bucket?

1

8 Answers 8

155

You can access your files via SSL like this:

https://s3.amazonaws.com/bucket_name/images/logo.gif

If you use a custom domain for your bucket, you can use S3 and CloudFront together with your own SSL certificate (or generate a free one via Amazon Certificate Manager): http://aws.amazon.com/cloudfront/custom-ssl-domains/

6
  • 45
    That's not entirely true. You can use bucket names without dots: this-is-my-awesome-bucket.s3.amazonaws.com Amazon has a wildcard certificate. Since you can't use dots, you can't have a CNAME domain pointing to your bucket.
    – Docunext
    Apr 20, 2013 at 19:18
  • 4
    watch out for bucket names containing periods! the SSL won't work on iOS devices but will work just fine in Chrome. See stackoverflow.com/questions/3048236/… May 14, 2014 at 20:47
  • 1
    Amazon CloudFront will do this for you.
    – Greg
    May 29, 2015 at 10:36
  • 1
    @Docunext the problem is that a bucket name without dot makes it hard to use a custom DNS domain. See stackoverflow.com/questions/32714351/… Sep 22, 2015 at 10:23
  • 4
    To have dot notation bucket names (so you can use Route 53 alias) and you want to PUT objects in via REST, ensure the hostname matches the region. For example, my bucket is in us-west-2 so the hostname is actually s3-us-west-2.amazonaws.com otherwise you get an error.
    – noetix
    Jun 9, 2016 at 6:00
27

Custom domain SSL certs were just added today for $600/cert/month. Sign up for your invite below: http://aws.amazon.com/cloudfront/custom-ssl-domains/

Update: SNI customer provided certs are now available for no additional charge. Much cheaper than $600/mo, and with XP nearly killed off, it should work well for most use cases.

@skalee AWS has a mechanism for achieving what the poster asks for, "implement SSL for an Amazon s3 bucket", it's called CloudFront. I'm reading "implement" as "use my SSL certs," not "just put an S on the HTTP URL which I'm sure the OP could have surmised.

Since CloudFront costs exactly the same as S3 ($0.12/GB), but has a ton of additional features around SSL AND allows you to add your own SNI cert at no additional cost, it's the obvious fix for "implementing SSL" on your domain.

7
  • 68
    CloudFront is not S3.
    – skalee
    Jul 18, 2013 at 11:15
  • 6
    @skalee Correct, but if you want to access it via a domain with custom SSL certs, as the OP requests, you can set up custom CNAME SSL certs that this way and access it through CF. Jul 18, 2013 at 16:30
  • 2
    For the time being, I've set up two CNAMEs: static-s3 and static-cf, the first one pointing straight to my S3, the second to CF. First can not support SSL, second can, but it's CF and not S3 as skalee points out. That's the best I think we can do as of now.
    – Danger
    Nov 12, 2013 at 16:52
  • 2
    WOW I guess they have to make up for increasingly cheaper storage costs somehow. at least it's prorated though. if you only use your SSL certificate for 1 hour in a month it's only $20 ;-) May 14, 2014 at 19:26
  • 2
    @Elegant.Scripting if you have a dedicated SSL certificate (not a SNI certificate) then that machine needs a dedicated IP which incurs costs. presumably a dedicated IP is needed for you for every location around the world where S3 is hosting your data. So that adds up. But I think it is mainly just that post people don't need it and they can jack the price up for those who do. If you don't need to support IE6 then you should be OK with SNI certificate under CloudFront. May 16, 2016 at 22:27
13

I found you can do this easily via the Cloud Flare service.

Set up a bucket, enable webhosting on the bucket and point the desired CNAME to that endpoint via Cloudflare... and pay for the service of course... but $5-$20 VS $600 is much easier to stomach.

Full detail here: https://www.engaging.io/easy-way-to-configure-ssl-for-amazon-s3-bucket-via-cloudflare/

1
4

It is not possible directly with S3, but you can create a Cloud Front distribution from you bucket. Then go to certificate manager and request a certificate. Amazon gives them for free. Ones you have successfully confirmed the certification, assign it to your Cloud Front distribution. Also remember to set the rule to re-direct http to https.

I'm hosting couple of static websites on Amazon S3, like my personal website to which I have assigned the SSL certificate as they have the Cloud Front distribution.

2
  • and how did you assign the domain name? Nov 15, 2017 at 18:05
  • First go to the certificate manager and request a new certificate. Add your domain there and also include subdomains there, if necessary. Doesn't really hurt anything to put subdomains there, so might as well just put example.com and *.example.com there. Dec 4, 2017 at 22:34
3

If you really need it, consider redirections.

For example, on request to assets.my-domain.example.com/path/to/file you could perform a 301 or 302 redirection to my-bucket-name.s3.amazonaws.com/path/to/file or s3.amazonaws.com/my-bucket-name/path/to/file (please remember that in the first case my-bucket-name cannot contain any dots, otherwise it won't match *.s3.amazonaws.com, s3.amazonaws.com stated in S3 certificate).

Not tested, but I believe it would work. I see few gotchas, however.

The first one is pretty obvious, an additional request to get this redirection. And I doubt you could use redirection server provided by your domain name registrar — you'd have to upload proper certificate there somehow — so you have to use your own server for this.

The second one is that you can have urls with your domain name in page source code, but when for example user opens the pic in separate tab, then address bar will display the target url.

1
  • 2
    I'm not certain but I think this could cause CORS problems.
    – xdhmoore
    Mar 1, 2018 at 22:57
1

As mentioned before, you cannot create free certificates for S3 buckets. However, you can create Cloud Front distribution and then assign the certificate for the Cloud Front instead. You request the certificate for your domain and then just assign it to the Cloud Front distribution in the Cloud Front settings. I've used this method to serve static websites via SSL as well as serve static files.

For static website creation Amazon is the go to place. It is really affordable to get a static website with SSL.

1
  • 4
    For everybody who gets here using google: Remember to create your AWS certificate (also) in the N. Virginia region. Otherwise you wont be able to select it in your CF distribution
    – KLoozen
    Mar 21, 2018 at 11:42
0

The absolute easiest way to add DNS/SSL to an Amazon S3 bucket, is to use CloudFlare workers!

I found this juicy little nugget which did the trick.
https://fershad.com/writing/proxy-aws-s3-content-cloudflare-workers/

Note, use the correct region in the hostname (i.e. us-west-1, us-west-2).

Done and done!

addEventListener('fetch', event => {
  event.respondWith(handleRequest(event))
})

async function handleRequest(event) {
  let requestFolder = '/files'
  let s3Folder = '/'
  
  let url = new URL(event.request.url)
  const cache = caches.default

  let origPathname = url.pathname
  const filename = url.toString().split('/').pop()

  url.hostname = 'bucket-name.s3-us-west-2.amazonaws.com'
  url.pathname = origPathname.replace(new RegExp('^'+escapeRegExp(requestFolder)), s3Folder)

  response = await fetch(url)
  response = new Response(response.body, { ...response})

  return response;
}

function escapeRegExp(string) {  
  return string.replace(/[.*+?^${}()|[\]\\\/]/g, '\\$&');
}


0

This can be Done using Nginx and CertBot like as bellow:

Step 1: Install Nginx and CertBot to your server instance like (Ec2 or any third party)

Step 2: Create on file inside Nginx configuration directory

/etc/nginx/conf.d/your_file_name.conf

With following content

server {
    listen 80;
    server_name subkeyword.yourdomain.com;

location / {

    proxy_pass http://your_bucket_name.s3-website.your_region.amazonaws.com;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
}
}

Step 3: Execute following command to create certificate for your subdomain

sudo certbot --nginx -d subkeyword.yourdomain.com

Note: A record should be there for server IP in your domain hosted zone

Not the answer you're looking for? Browse other questions tagged or ask your own question.