Skip to content

Commit 64c3c6b

Browse files
RomainMullerRomainMuller
committed
fix(cloudfront): Use regional endpoint for S3 bucket origins
The regional endpoint has to be used for S3 bucket origins, otherwise CloudFront will receive an HTTP 302 response (redirecting to the regional endpoint), which it will cache. This will lead to users seeing the actual bucket endpoint, instead of it being hidden behind the CloudFront distribution.
1 parent 5ac6e77 commit 64c3c6b

8 files changed

+240
-77
lines changed

‎packages/@aws-cdk/aws-cloudfront/lib/web_distribution.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -566,7 +566,7 @@ export class CloudFrontWebDistribution extends cdk.Construct implements route53.
566566
const originProperty: CfnDistribution.OriginProperty = {
567567
id: originId,
568568
domainName: originConfig.s3OriginSource
569-
? originConfig.s3OriginSource.s3BucketSource.bucketDomainName
569+
? originConfig.s3OriginSource.s3BucketSource.bucketRegionalDomainName
570570
: originConfig.customOriginSource!.domainName,
571571
originPath: originConfig.originPath,
572572
originCustomHeaders: originHeaders.length > 0 ? originHeaders : undefined,
@@ -660,7 +660,7 @@ export class CloudFrontWebDistribution extends cdk.Construct implements route53.
660660
distributionConfig = {
661661
...distributionConfig,
662662
logging: {
663-
bucket: this.loggingBucket.bucketDomainName,
663+
bucket: this.loggingBucket.bucketRegionalDomainName,
664664
includeCookies: props.loggingConfig.includeCookies || false,
665665
prefix: props.loggingConfig.prefix
666666
}

‎packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-alias-target.expected.json

+67-67
Original file line numberDiff line numberDiff line change
@@ -1,78 +1,78 @@
11
{
2-
"Resources": {
3-
"HostedZoneDB99F866": {
4-
"Type": "AWS::Route53::HostedZone",
5-
"Properties": {
6-
"Name": "test.public."
7-
}
8-
},
9-
"HostedZoneAlias40D2E006": {
10-
"Type": "AWS::Route53::RecordSet",
11-
"Properties": {
12-
"Name": "_foo.test.public.",
13-
"Type": "A",
14-
"AliasTarget": {
15-
"DNSName": {
16-
"Fn::GetAtt": [
17-
"MyDistributionCFDistributionDE147309",
18-
"DomainName"
19-
]
20-
},
21-
"HostedZoneId": "Z2FDTNDATAQYW2"
2+
"Resources": {
3+
"HostedZoneDB99F866": {
4+
"Type": "AWS::Route53::HostedZone",
5+
"Properties": {
6+
"Name": "test.public."
7+
}
8+
},
9+
"HostedZoneAlias40D2E006": {
10+
"Type": "AWS::Route53::RecordSet",
11+
"Properties": {
12+
"Name": "_foo.test.public.",
13+
"Type": "A",
14+
"AliasTarget": {
15+
"DNSName": {
16+
"Fn::GetAtt": [
17+
"MyDistributionCFDistributionDE147309",
18+
"DomainName"
19+
]
2220
},
23-
"HostedZoneId": {
24-
"Ref": "HostedZoneDB99F866"
25-
}
21+
"HostedZoneId": "Z2FDTNDATAQYW2"
22+
},
23+
"HostedZoneId": {
24+
"Ref": "HostedZoneDB99F866"
2625
}
27-
},
28-
"Bucket83908E77": {
29-
"Type": "AWS::S3::Bucket"
30-
},
31-
"MyDistributionCFDistributionDE147309": {
32-
"Type": "AWS::CloudFront::Distribution",
33-
"Properties": {
34-
"DistributionConfig": {
35-
"CacheBehaviors": [],
36-
"DefaultCacheBehavior": {
37-
"AllowedMethods": [
38-
"GET",
39-
"HEAD"
40-
],
41-
"CachedMethods": [
42-
"GET",
43-
"HEAD"
44-
],
45-
"ForwardedValues": {
46-
"Cookies": {
47-
"Forward": "none"
48-
},
49-
"QueryString": false
26+
}
27+
},
28+
"Bucket83908E77": {
29+
"Type": "AWS::S3::Bucket"
30+
},
31+
"MyDistributionCFDistributionDE147309": {
32+
"Type": "AWS::CloudFront::Distribution",
33+
"Properties": {
34+
"DistributionConfig": {
35+
"CacheBehaviors": [],
36+
"DefaultCacheBehavior": {
37+
"AllowedMethods": [
38+
"GET",
39+
"HEAD"
40+
],
41+
"CachedMethods": [
42+
"GET",
43+
"HEAD"
44+
],
45+
"ForwardedValues": {
46+
"Cookies": {
47+
"Forward": "none"
5048
},
51-
"TargetOriginId": "origin1",
52-
"ViewerProtocolPolicy": "redirect-to-https"
49+
"QueryString": false
5350
},
54-
"DefaultRootObject": "index.html",
55-
"Enabled": true,
56-
"HttpVersion": "http2",
57-
"IPV6Enabled": true,
58-
"Origins": [
59-
{
60-
"DomainName": {
61-
"Fn::GetAtt": [
62-
"Bucket83908E77",
63-
"DomainName"
64-
]
65-
},
66-
"Id": "origin1",
67-
"S3OriginConfig": {}
68-
}
69-
],
70-
"PriceClass": "PriceClass_100",
71-
"ViewerCertificate": {
72-
"CloudFrontDefaultCertificate": true
51+
"TargetOriginId": "origin1",
52+
"ViewerProtocolPolicy": "redirect-to-https"
53+
},
54+
"DefaultRootObject": "index.html",
55+
"Enabled": true,
56+
"HttpVersion": "http2",
57+
"IPV6Enabled": true,
58+
"Origins": [
59+
{
60+
"DomainName": {
61+
"Fn::GetAtt": [
62+
"Bucket83908E77",
63+
"RegionalDomainName"
64+
]
65+
},
66+
"Id": "origin1",
67+
"S3OriginConfig": {}
7368
}
69+
],
70+
"PriceClass": "PriceClass_100",
71+
"ViewerCertificate": {
72+
"CloudFrontDefaultCertificate": true
7473
}
7574
}
7675
}
7776
}
7877
}
78+
}

‎packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-bucket-logging.expected.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
"Bucket": {
3535
"Fn::GetAtt": [
3636
"Bucket83908E77",
37-
"DomainName"
37+
"RegionalDomainName"
3838
]
3939
},
4040
"IncludeCookies": true,
@@ -104,7 +104,7 @@
104104
"Bucket": {
105105
"Fn::GetAtt": [
106106
"AnAmazingWebsiteProbably2LoggingBucket222F7CE9",
107-
"DomainName"
107+
"RegionalDomainName"
108108
]
109109
},
110110
"IncludeCookies": false

‎packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-ipv6-disabled.expected.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
"DomainName": {
3636
"Fn::GetAtt": [
3737
"Bucket83908E77",
38-
"DomainName"
38+
"RegionalDomainName"
3939
]
4040
},
4141
"Id": "origin1",

‎packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-s3.expected.json

+133
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
{
2+
"Resources": {
3+
"Bucket83908E77": {
4+
"Type": "AWS::S3::Bucket"
5+
},
6+
"BucketPolicyE9A3008A": {
7+
"Type": "AWS::S3::BucketPolicy",
8+
"Properties": {
9+
"Bucket": {
10+
"Ref": "Bucket83908E77"
11+
},
12+
"PolicyDocument": {
13+
"Statement": [
14+
{
15+
"Action": [
16+
"s3:Get*",
17+
"s3:List*"
18+
],
19+
"Effect": "Allow",
20+
"Principal": {
21+
"CanonicalUser": {
22+
"Fn::GetAtt": [
23+
"OAI",
24+
"S3CanonicalUserId"
25+
]
26+
}
27+
},
28+
"Resource": [
29+
{
30+
"Fn::GetAtt": [
31+
"Bucket83908E77",
32+
"Arn"
33+
]
34+
},
35+
{
36+
"Fn::Join": [
37+
"",
38+
[
39+
{
40+
"Fn::GetAtt": [
41+
"Bucket83908E77",
42+
"Arn"
43+
]
44+
},
45+
"/*"
46+
]
47+
]
48+
}
49+
]
50+
}
51+
],
52+
"Version": "2012-10-17"
53+
}
54+
}
55+
},
56+
"OAI": {
57+
"Type": "AWS::CloudFront::CloudFrontOriginAccessIdentity",
58+
"Properties": {
59+
"CloudFrontOriginAccessIdentityConfig": {
60+
"Comment": "Allows CloudFront to reach to the bucket!"
61+
}
62+
}
63+
},
64+
"DistributionCFDistribution882A7313": {
65+
"Type": "AWS::CloudFront::Distribution",
66+
"Properties": {
67+
"DistributionConfig": {
68+
"CacheBehaviors": [],
69+
"DefaultCacheBehavior": {
70+
"AllowedMethods": [
71+
"GET",
72+
"HEAD"
73+
],
74+
"CachedMethods": [
75+
"GET",
76+
"HEAD"
77+
],
78+
"ForwardedValues": {
79+
"Cookies": {
80+
"Forward": "none"
81+
},
82+
"QueryString": false
83+
},
84+
"TargetOriginId": "origin1",
85+
"ViewerProtocolPolicy": "redirect-to-https"
86+
},
87+
"DefaultRootObject": "index.html",
88+
"Enabled": true,
89+
"HttpVersion": "http2",
90+
"IPV6Enabled": true,
91+
"Origins": [
92+
{
93+
"DomainName": {
94+
"Fn::GetAtt": [
95+
"Bucket83908E77",
96+
"RegionalDomainName"
97+
]
98+
},
99+
"Id": "origin1",
100+
"S3OriginConfig": {
101+
"OriginAccessIdentity": {
102+
"Fn::Join": [
103+
"",
104+
[
105+
"origin-access-identity/cloudfront/",
106+
{
107+
"Ref": "OAI"
108+
}
109+
]
110+
]
111+
}
112+
}
113+
}
114+
],
115+
"PriceClass": "PriceClass_100",
116+
"ViewerCertificate": {
117+
"CloudFrontDefaultCertificate": true
118+
}
119+
}
120+
}
121+
}
122+
},
123+
"Outputs": {
124+
"DistributionDomainName": {
125+
"Value": {
126+
"Fn::GetAtt": [
127+
"DistributionCFDistribution882A7313",
128+
"DomainName"
129+
]
130+
}
131+
}
132+
}
133+
}

‎packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-s3.ts

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
import iam = require('@aws-cdk/aws-iam');
2+
import s3 = require('@aws-cdk/aws-s3');
3+
import cdk = require('@aws-cdk/cdk');
4+
import cloudfront = require('../lib');
5+
6+
const app = new cdk.App();
7+
const stack = new cdk.Stack(app, 'integ-cloudfront-s3');
8+
9+
const bucket = new s3.Bucket(stack, 'Bucket', { removalPolicy: cdk.RemovalPolicy.Destroy });
10+
const oai = new cloudfront.CfnCloudFrontOriginAccessIdentity(stack, 'OAI', {
11+
cloudFrontOriginAccessIdentityConfig: {
12+
comment: 'Allows CloudFront to reach to the bucket!',
13+
}
14+
});
15+
const dist = new cloudfront.CloudFrontWebDistribution(stack, 'Distribution', {
16+
originConfigs: [{
17+
behaviors: [{ isDefaultBehavior: true }],
18+
s3OriginSource: {
19+
s3BucketSource: bucket,
20+
originAccessIdentityId: oai.cloudFrontOriginAccessIdentityId,
21+
},
22+
}]
23+
});
24+
bucket.addToResourcePolicy(new iam.PolicyStatement()
25+
.allow()
26+
.addActions('s3:Get*', 's3:List*')
27+
.addResources(bucket.bucketArn, bucket.arnForObjects('*'))
28+
.addCanonicalUserPrincipal(oai.cloudFrontOriginAccessIdentityS3CanonicalUserId));
29+
30+
new cdk.CfnOutput(stack, 'DistributionDomainName', { value: dist.domainName });

‎packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront.expected.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
"DomainName": {
3636
"Fn::GetAtt": [
3737
"Bucket83908E77",
38-
"DomainName"
38+
"RegionalDomainName"
3939
]
4040
},
4141
"Id": "origin1",
@@ -50,4 +50,4 @@
5050
}
5151
}
5252
}
53-
}
53+
}

‎packages/@aws-cdk/aws-cloudfront/test/test.basic.ts

+3-3
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,7 @@ export = {
130130
"DomainName": {
131131
"Fn::GetAtt": [
132132
"Bucket83908E77",
133-
"DomainName"
133+
"RegionalDomainName"
134134
]
135135
},
136136
"Id": "origin1",
@@ -205,7 +205,7 @@ export = {
205205
"DomainName": {
206206
"Fn::GetAtt": [
207207
"Bucket83908E77",
208-
"DomainName"
208+
"RegionalDomainName"
209209
]
210210
},
211211
"Id": "origin1",
@@ -283,7 +283,7 @@ export = {
283283
"DomainName": {
284284
"Fn::GetAtt": [
285285
"Bucket83908E77",
286-
"DomainName"
286+
"RegionalDomainName"
287287
]
288288
},
289289
"Id": "origin1",

0 commit comments

Comments
 (0)