Re:Show HN: How to Make an AWS S3 Static Website with SSL
by fishdaemon on Saturday March 10, 2018 @05:02AM
(#16557920)
Another important aspect of using AOI is that you don't need to make the s3 bucket public. This matters even if the website is fully public. It has to do with a simple governance rule. No public s3 buckets should be allowed.
That if monitored and enforced would stop many data breaches. With some public bucketd enforcement will be difficult
Re:Show HN: How to Make an AWS S3 Static Website with SSL
by justinsaccount on Saturday March 10, 2018 @07:09AM
(#16558176)
Default object only works at the root of the site. Making it work everywhere is quite a bit more complicated
https://aws.amazon.com/blogs/compute/implementing-default-di...
Re:Show HN: How to Make an AWS S3 Static Website with SSL
by greatamerican on Saturday March 10, 2018 @03:21AM
(#16557678)
Very interesting. I'll check this out.
A better way is to completely leave the "website" bits of S3 off, and leave that all up to CloudFront. You can create an Origin Access Identity, then grant that OAI access to read your S3 bucket (all automated in the wizard when you create a CF dist and specify an S3 origin). You then specify a default object in your CF dist, and bam, CF is using the S3 REST API over SSL to secure that CF-S3 hop.