proposed changes
MODIFY
aws-ts-static-website/index.ts
aws-ts-static-website/index.ts
@@ -29,7 +29,6 @@ const config = {
const contentBucket = new aws.s3.Bucket("contentBucket",
{
bucket: config.targetDomain,
- acl: "public-read",
// Configure S3 to serve bucket contents as a website. This way S3 will automatically convert
// requests for "foo/" to "foo/index.html".
website: {
@@ -154,6 +153,11 @@ if (config.certificateArn === undefined) {
certificateArn = certificateValidation.certificateArn;
}
+// Generate Origin Access Identity to access the private s3 bucket.
+const originAccessIdentity = new aws.cloudfront.OriginAccessIdentity("originAccessIdentity", {
+ comment: "this is needed to setup s3 polices and make s3 not public."
+});
+
// if config.includeWWW include an alias for the www subdomain
const distributionAliases = config.includeWWW ? [config.targetDomain, `www.${config.targetDomain}`] : [config.targetDomain];
@@ -171,13 +175,8 @@ const distributionArgs: aws.cloudfront.DistributionArgs = {
{
originId: contentBucket.arn,
domainName: contentBucket.websiteEndpoint,
- customOriginConfig: {
- // Amazon S3 doesn't support HTTPS connections when using an S3 bucket configured as a website endpoint.
- // https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginProtocolPolicy
- originProtocolPolicy: "http-only",
- httpPort: 80,
- httpsPort: 443,
- originSslProtocols: ["TLSv1.2"],
+ s3OriginConfig: {
+ originAccessIdentity: originAccessIdentity.cloudfrontAccessIdentityPath
},
},
],
@@ -296,6 +295,23 @@ function createWWWAliasRecord(targetDomain: string, distribution: aws.cloudfront
);
}
+const bucketPolicy = new aws.s3.BucketPolicy("bucketPolicy", {
+ bucket: contentBucket.id, // refer to the bucket created earlier
+ policy: JSON.stringify({
+ Version: "2012-10-17",
+ Statement: [
+ {
+ Effect: "Allow",
+ Principal: originAccessIdentity.iamArn, // Only allow Cloudfront read access.
+ Action: ["s3:GetObject"],
+ Resource: [
+ contentBucket.arn.apply((bucketArn: string) =>`${bucketArn}/*`), // Give Cloudfront access to the entire bucket.
+ ],
+ },
+ ],
+ })
+});
+
const aRecord = createAliasRecord(config.targetDomain, cdn);
if (config.includeWWW) {
const cnameRecord = createWWWAliasRecord(config.targetDomain, cdn);

proposed changes