AWS Get Pre-Signed URL with custom domain

user_7061173 0
Viewed 9367

Following is what I'm doing. I'm generating a pre-signed URL using a custom domain for my s3 bucket resources which are not public.

https://files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX

Also to add the certificate I've created a cloudfront distribution for the bucket having following origin settings

Origin Domain Name: bucket-name.s3.amazonaws.com Origin Id : s3.bucket-name Restrict Bucket Access: No

Yet I'm unable to access my resources. Throws access denied error. Any help would be appreciated.

pre-signed-url aws-sdk amazon-cloudfront amazon-web-services amazon-s3
4 Answers

There are two cases:

  1. If your bucket has regular name.

In this case you should use CloudFront to access your bucket. And like mentioned above URL looks like in this answer:

https://cloudfront-url/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX

  1. If your bucket has s3 static website name.

In this case your bucket name looks like files.customdomain.com and you can generate pre-signed url for this bucket:

https://files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX

In your DNS you will have CNAME files.customdomain.com points to files.customdomain.com.s3.[bucket-region].amazonaws.com.

NOTICE

When I generate pre-signed URL via aws-cli:

aws s3 presign s3://files.customdomain.com/file123 --endpoint-url https://files.customdomain.com

I get URL with duplicate bucket name in the path: https://files.customdomain.com/files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX

instead of:

https://files.customdomain.com/file123?AWSAccessKeyId=XXX&Expires=1541220685&Signature=XXXX

I don't know if it has the same behavior via SDK.

user_66445840
user_44867910
user_16959060
user_70611730
Related