title: S3 static website with CloudFront restricted to specific IP range using custom header
body: <p>I would like to deploy to a website to a S3 bucket and use static website hosting.  However, I have some strict security restrictions:</p>
  
  <ol>
  <li>HTTPS must be used</li>
  <li>Access to the website must be restricted to a specific IP range</li>
  </ol>
  
  <p>Here is my plan:</p>
  
  <ul>
  <li>Use AWS WAF to restrict the IPs that can access the website</li>
  <li>Use CloudFront to leverage HTTPS</li>
  <li>Format the CloudFront distribution to forward a custom header that will act like an access key to S3</li>
  <li>Restrict the S3 bucket security policy to only allow traffic that includes the custom header from CloudFront mentioned above.</li>
  </ul>
  
  <p>Here is a diagram:</p>
  
  <p><a href="https://i.stack.imgur.com/LI5Mg.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/LI5Mg.png" alt="enter image description here"></a></p>
  
  <p>I have one big concern though:  Is forwarding a custom header between CloudFront <em>really</em> the best way to do this?  AWS docs say that an Origin Access Identity can't be used for S3 buckets that act as a website (<a href="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html</a>).  The custom header seems less secure than an Origin Access Identity and much harder to maintain.  It makes me uncomfortable using a random string as the only security preventing someone from bypassing my CloudFront distribution and directly accessing the S3 bucket.  If a malicious party guesses the </p>
  
  <p>My other option here is to just bite the bullet and move to servers where I have more control over a lot of the security but I would like to leverage the convenience of an S3 website.</p>