56

We currently want to start hosting all our assets through AWS S3 and we also want to server everything over https. I understand I can use the Amazon Certificate Manager (ACM) with Cloudfront to server assets over https. The problem is that we are in the medical industry and we are legally prohibited to host anything outside the EU. With S3 I can choose a location (Frankfurt for us), but with Cloudfront I just get this option:

enter image description here

So I thought that I could maybe use Letsencrypt to generate my own certs. But I think I then still need to use ACM which only works with Cloudfront, which means I still can't use it.

Does anybody know if I can somehow setup S3 with https but without cloudfront?

4 Answers 4

36

Unfortunately you can't use an SSL certificate with your custom domain with S3. You can use the S3 domain with the Amazon SSL certificate like: https://my-example-bucket.s3-website-us-east-1.amazonaws.com.

If you want to use a custom domain with SSL, and you can't use CloudFront, then you will need to look into placing some other proxy in front of S3 like your own Nginx server or something.

9
  • 1
    @kramer65 You could also look into other CDNs instead of CloudFront if there is a CDN that meets your business requirements.
    – Mark B
    Feb 24, 2017 at 16:06
  • 18
    Am I correct that as of June 2018, https for my-example-bucket.s3-website-us-east-1.amazonaws.com no longer works? It looks like its now only available on http?
    – paul
    Jun 27, 2018 at 22:34
  • 3
    @Annjawn all of that is addressed in the original question. The original question states that they don't want to use CloudFront.
    – Mark B
    Jul 19, 2018 at 11:01
  • 3
    There is a note under the section "Amazon Simple Storage Service Website Endpoints" in <docs.aws.amazon.com/general/latest/gr/rande.html>, stating "The website endpoints do not support https.". So, those s3-website endpoints do not support HTTPS anymore. Oct 24, 2018 at 7:51
  • 1
    The statement "Amazon S3 website endpoints do not support HTTPS. " has been moved to docs.aws.amazon.com/AmazonS3/latest/userguide/…
    – magicbacon
    Apr 2, 2021 at 19:20
5

In AWS API Gateway, you can create a proxy resource /{proxy+} that maps to s3-website.

Be sure to map not to s3 alone, but s3-website, so you get PATH/TO/DIR/index.html returned for PATH/TO/DIR, and possibly other things working as desired.

API Gateway is served over HTTPS, optionally under your own domain.

This is not very good option though, because you have to manually add all allowed HTTP return codes, and there's a limit of 10MB payload in a request, as this service is aimed at REST APIs.

1
  • 1
    API gateway isn't actually any cheaper that CloudFront. Besides being a hacky solution, you can't connect to API gateway by http. Since most browsers default to http if no protocol is given, this causes a bad experience. CloudFront can redirect http to https. If you're using API gateway for an API that is great. But for a html website, use CloudFront or a non-aws service. Mar 29, 2021 at 2:52
1

Below is a useful resource schedule. Both S3 and CloudFront are available in the EU. You can certainly present S3 via CloudFront.

I understand the requirements to host within a territorial boundary. The req'ts for that you will achieve with S3 in the EU region. CloudFront is not a hosting service it is a CDN (Content Delivery network) using high performance leased lines and manageable endpoint caching. The issue you are looking at is the price options, not the hosting location. If you want to serve content in the EU you would want 'Price Class 100' or 'Price Class All'.

When using CloudFront you can control both which IP ranges that can access your material, and the encryption of both front-end and back-end traffic. Check out some of the design patterns

There are some excellent white papers and design patterns for setting up secure CloudFront. I think you will find that you can do what you want and stay well within the legal requirements.

http://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region https://aws.amazon.com/compliance/eu-data-protection/

Also check out AWS doco 'using-https-cloudfront-to-s3-origin' & 'custom-ssl-domains'

P.S. Ensure that you set the bucket permissions to only be available via the CloudFront channel.

RL

1

CloudFront has a feature for white/blacklisting countries. I would try using any of the 3 CDN options you listed along with a whitelist of EU countries. I'm not sure what the easiest way to verify that other countries (e.g. US) are denied though.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.