After some searching and struggling with this for a long time I found a page that says that CarrierWave doesn't support CloudFront signed urls. CloudFront signed urls are different than S3 signed urls, which caused me some confusion. Once I figured that out, it was a lot easier to know what to do.
If you configure CarrierWave with config.fog_public = false
then it will automatically begin signing S3 urls, but it can't be configured to work with Fog
and CloudFront private content in the version of CarrierWave I'm using (1.0.0)
. I even tried using the carrierwave-aws
gem and that didn't help either.
So what would happen is that CarrierWave would sign the URL and the host would look something like this:
https://my_bucket_name.s3-us-west-2.amazonaws.com/uploads/...?signature...
That points directly to the S3 bucket, but I needed it to point to CloudFront. I needed the host to look like this:
https://s3.cloudfront_domain_name.com/uploads/...
And what would happen if I set config.asset_host
equal to my CloudFront location is I'd get this, (with double slashes before "uploads"):
https://s3.cloudfront_domain_name.com//uploads/...
That, too, made it clear CarrierWave wasn't yet designed to be used with CloudFront. Hopefully they'll improve it. This was my work-around. It's ugly, but it worked to get done what I needed without needing to modify CarrierWave itself, as I hope CarrierWave will at some point add support for CloudFront.
- First I did a regex find/replace on my url and removed the S3 host portion
and put on my CloudFront host portion.
cf_url = s3_url.gsub("my_bucket_name.s3-us-west-2.amazonaws.com", "s3.cloudfront_domain_name.com")
- Next I did another regex find/replace
to remove the S3 signed url at the end of the string:
non_signed_cf_url = cf_url.gsub(/\?.+/, '')
This is because the signature will be incorrect because it was using the API for S3 and not for CloudFront for signing the URL.
- Now I re-sign the URL myself, using the
cloudfront-signer
gem:
signed_cf_url = Aws::CF::Signer.sign_url(non_signed_cf_url, :expires => 1.day.from_now)
There are a few other things you need to be aware of when serving private content on CloudFront:
- In the Cache Behavior Settings for your path pattern (not necessarily the default one), set: "Restrict Viewer Access
(Use Signed URLs or
Signed Cookies)" to "Yes"
- Set "Trusted Signers" to "self"
- Set "Query String Forwarding and Caching" to "Forward all, cache based on all" if you want to use other query strings more than the CloudFront signature in your url, such as
response-content-disposition
and response-content-type
(I was able to get these to work successfully, but they have to be url_encoded properly.)
- In your CloudFront Origin Settings, set your access-identity and set "Grant Read Permissions on Bucket" to "Yes, Update Bucket Policy"
- In your General Distribution Settings, make sure "Distribution State" is "Enabled" and that you've added a CNAME to "Alternate Domain Names
(CNAMEs)" if you're using one.
- If using a CNAME, make sure your DNS is correctly configured to point it to your CloudFront distribution's name.
- Lastly, once you set the configurations there is a long wait while AWS updates the distribution, so you won't see your changes happen right away. It may seem like your app/website is still broken until the changes propagate through CloudFront. This can make configuring it difficult because if you get it wrong you have to wait a long time before you can see your changes take effect and you may not be sure what happened. But with these settings I was able to get it working for me.
- You can also create more than one caching path pattern so that some content is private and requires a CloudFront signed url, and other content isn't. For example, I set a path pattern of
*.mp4
that requires a signature for all mp4 files and placed that above the default behavior. And then I have the default cache behavior set to NOT require signed urls, which allows all other files - such as images - to be publicly accessible through the CloudFront distribution.
fog_host
, then I get this error: undefined method `fog_host=' for CarrierWave::Uploader::Base:Class What version of carrierwave are people using?config.asset_host
instead ofconfig.fog_host
. I have added this issue to question. Good luck!