Connecting GovCloud S3 resource with CloudFront

user_2526327 0
Viewed 384

Can we connect a Non-Public s3 bucket sitting on AWS Gov Cloud to a cloudfront distribution on a non gov cloud AWS account. There is not much docs or steps given anywhere.

We did try connecting it with Canonical Account ID, Cloudfront Origin in the s3 bucket policy. But nothing has worked so far.

Is this not possible or is there a way to achieve this?

Edit:

I ask this because there is a section of AWS docs talks about tips on having gov-cloud s3 content on cloudfront. But it has no details on how to do it.

Link: https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/setting-up-cloudfront-tips.html

amazon-cloudfront amazon-web-services amazon-s3
2 Answers

It is hard to see how that would be possible.

AWS GovCloud regions are physically isolated, including logical network isolation from all other AWS regions, except for very specific service endpoints.

user_14696630

Here is another solution, provided in the official AWS documentation: https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-serve-static-website/

For Origin Custom Headers, under Header Name, enter Referer. Under Value, enter a custom header that you want to forward to the origin (S3 bucket). To restrict access to the origin, you can enter a random or secret value that only you know.

Basically, Cloudfront will use a custom header containing a secret value, your S3 bucket on govcloud will be public read access with a custom policy to allow only this secret value in the header. Don't forget to force HTTPS between cloudfront and your govcloud s3 bucket with OriginProtocolPolicy https-only set.

user_133071640
Related