Configuring S3 bucket for virtual-hosted style requests causing SSL error

DevOps AWS
1

Hi everyone! I have created S3 bucket named “http://sub.domain.com|sub.domain.com” to use as <https://docs.aws.amazon.com/AmazonS3/latest/userguide/VirtualHosting.html#virtual-hosted-style-access|Virtual-hosted–style requests>. I have mapped my “http://sub.domain.com|sub.domain.com” to “http://sub.domain.com.s3.region-code.amazonaws.com|sub.domain.com.s3.region-code.amazonaws.com” in DNS records.

Issue is When I used bucket image object in my web app in html img src tag like “https://sub.domain.com/image.jpg”, I got (failed)net::ERR_CERT_COMMON_NAME_INVALID error status.

My SSL certificate is wildcard certificate *.http://domain.com|domain.com

Bucket is public, Image is accessed by http, but not https.

2

To be able to use HTTPS you need to deploy and serve content through CloudFront. You can’t use your own certificate with S3 bucket.

3

If I use CloudFront, How can I restrict access to only my web app?

4

WAF Web ACL or Lambda@Edge. It depends what you mean by “restrict access”.

5

Mean to say that, my bucket images can only be access in my web app Html img tag. Not via browser url.

6

You can use CORS with CloudFront and S3.

7

I tried CORS with S3 but it didn’t work. Do we have CORS option in Cloudfront ?

8

I restrict access using “Condtions” section in Bucket policy in S3 like

“Condition”: {
“StringLike”: {
“aws:Referer”: [
“https://my.domain.com/*”
]
}
}

It worked and images can only be accessed by web app.

But as you said for Https , I need to use CloudFront. Thats why I am asking to have restrict option to only web app.

9

If you would like to rely on Referer header then you can use WAF or Lambda@Edge.

10

Yes I also know that its not secure to use Referer header.
okay Thank you!

11

Here is an example for User-agent: https://repost.aws/knowledge-center/waf-block-http-requests-no-user-agent
It will look very simiar for Referer header.