How to disable access to cloudfront via the *.cloudfront.net url?

user_2936565 0
Viewed 3556

I created an AOI to restrict access of the s3 bucket to public. So you can not access the s3 objects via the s3 endpoint but cloudfront can access all those objects and serve them.

I setup an Alternate Domain Names and add the SSL Certificate for this domain.

I setup route 53 with a A rule to alias cloudfront distribution

I can access the page using the Cloudfront public url (*.cloudfront.net) and mydomain.com

How can I remove the *.cloudfront.net access to my page? This should be possible because the only service that needs this url is route 53.

amazon-route53 amazon-cloudfront amazon-s3
3 Answers

Much easier than Lamda@Edge would be just to configure an ACL to block each request containing the Host header with your cloudfront distribution url.

Configure AWS WAF / ACL

user_63224450

You can use Lambda@Edge Viewer Request trigger. This allows you to inspect the request before the cache is checked, and either allow processing to continue or to return a generated response.

So, you can check the referer and make sure the request coming from your domain.

'use strict';

exports.handler = (event, context, callback) => {

  // extract the request object
  const request = event.Records[0].cf.request;

  // extract the HTTP `Referer` header if present
  // otherwise an empty string to simplify the matching logic
  const referer = (request.headers['referer'] || [ { value: '' } ])[0].value;

  // verify that the referring page is yours
  // replace example.com with your domain
  // add other conditions with logical or ||
  if(referer.startsWith('https://example.com/') ||
     referer.startsWith('http://example.com/'))
  {
    // return control to CloudFront and allow the request to continue normally
    return callback(null,request);
  }

  // if we get here, the referring page is not yours.
  // generate a 403 Forbidden response
  // you can customize the body, but the size is limited to ~40 KB

  return callback(null, {
    status: '403',
    body: 'Access denied.',
    headers: {
      'cache-control': [{ key: 'Cache-Control', value: 'private, no-cache, no-store, max-age=0' }],
      'content-type': [{ key: 'Content-Type', value: 'text/plain' }],
    }
  });
};

For more info read the following pages:

https://stackoverflow.com/a/51006128/6619626

Generating HTTP Responses in Request Triggers

Updating HTTP Responses in Origin-Response Triggers

Finally, this article has a lot of valuable info

How to Prevent Hotlinking by Using AWS WAF, Amazon CloudFront, and Referer Checking

user_66196260

Also, a very simple solution is to add a CloudFront function on the viewer request event for your behaviour in question:

function isCloudFrontURL(headers) {
    if(headers && headers["host"]) {
        if(headers["host"].value.includes("cloudfront"))
            return true
        else if(headers["host"].multiValue)
            return headers["host"].multiValue.some(entry => entry.value.includes("cloudfront"))
    }
    return false
}

function handler(event) {
    if(isCloudFrontURL(event.request.headers))
        return {
            statusCode: 404,
            statusDescription: 'Page not found',
            headers: {
                "content-type": { 
                    "value": "text/plain; charset=UTF-8" 
                    
                }
            }
        }
    else
        return event.request;
}
user_4404720
Related