9

I have a Web and I wanted to move its images to AWS S3. Say it's called mypage.com and I can access to an image like this:

https://mypage.com/pics/one.jpg

I created a bucket called static.mypage.com to put there all the images, so now I can access to the images like this:

https://static.mypage.com.s3.eu-west-1.amazonaws.com/pics/one.jpg

As it is a very long name, I want use a "shortener" using DNS.

So, I'd want to know how to set the CNAME in my DNS provider to make possible that if I go to...

https://static.mypage.com/pics/one.jpg

...I'd get the images from the bucket.

Thanks!

3
  • 2
    It's not sufficient just to have the CNAME: the web server also needs to be aware of your subdomain. Also, we can't tell how to add CNAME records at an unknown provider with an unknown configuration interface. Nov 8 '20 at 19:12
  • I just want to map every access to static.mypage.com to static.mypage.com.s3.eu-west-1.amazonaws.com
    – Ommadawn
    Nov 8 '20 at 19:14
  • Yes, but it doesn't work as you think. A CNAME merely tells that the hostname can be found on the same IP address, but it doesn't make the necessary application layer modifications to the HTTP request (Host header). Nov 8 '20 at 20:02
26

In the past S3 supported FQDN bucket names - i.e. exactly what you needed. Where FQDN = Fully Qualified Domain Name, i.e. full host name like static.mypage.com. The problem is that this only works with HTTP and not with HTTPS because there is no way to make S3 use a SSL certificate with your bucket name / host name (static.mypage.com).

You can still do it if you're happy with HTTP-only traffic. Simply create a static.mypage.com CNAME at your registrar pointing to s3.eu-west-1.amazonaws.com. S3 will recognise the Host: header in the request and look into the right S3 bucket. Provided that the objects in the bucket are publicly accessible the URL http://static.mypage.com/pics/one.jpg should work just fine.

However as soon as you access the same over HTTPS you will get a SSL Certificate Validation error because the hostname in the S3 certificate *.s3.eu-west-1.amazonaws.com won't match the expected static.mysite.com.

The solution is CloudFront which can sit in front of your S3 and handle the right SSL certificate for it:

  1. create a free SSL certificate for static.mysite.com in Amazon Certificate Manager (or upload your 3rd party issued SSL cert to ACM).
  2. set up a CloudFront distribution, attach the SSL cert to it
  3. configure the CloudFront distribution to use your S3 bucket as the Origin
  4. configure a static.mysite.com CNAME at your DNS provider to point to the CF distribution name, e.g. d123456abcdef.cloudfront.net
  5. with that your desired URL https://static.mypage.com/pics/one.jpg should finally work.

Also have a look at Routing traffic to a website that is hosted in an Amazon S3 bucket.

Hope that helps :)

5
  • Thank you very much. Very well explained and detailed solution :)
    – Ommadawn
    Nov 8 '20 at 22:01
  • Also cloudFront is a CDN meant exactly for your use case it improve serving and caching static content at edges locations.
    – Reda Salih
    Nov 8 '20 at 22:47
  • CloudFront will also reduce your costs in most cases, because serving bytes out of CloudFront costs a lot less than transferring bytes out of S3 (though on a cache miss you will pay both of those costs).
    – Riking
    Nov 9 '20 at 5:39
  • 1
    I don't think you pay for traffic from S3 to CloudFront edge locations any more @Riking . I'm not 100% sure but I think I read that a while back.
    – Tim
    Nov 9 '20 at 7:22
  • 2
    Allowing CloudFlare to proxy your S3 assets will also resolve the HTTPS problem at a dramatically lower cost than CloudFront. Nov 9 '20 at 19:49
1

Logon to your web host control panel and select “Manage DNS Server Settings” or similar Create a new CNAME entry for your domain. For your example of static.mypage.com, the entry is:

Name: static
Type: CNAME
Value: s3-external-3.amazonaws.com.

(If you are an American user, use s3.amazonaws.com. instead) And yes, the dot at the end of “s3-external-3.amazonaws.com.” is correct, for my web host. Look at your other entries to figure out what your should enter for your web host.

See here for more info https://carltonbale.com/how-to-alias-a-domain-name-or-sub-domain-to-amazon-s3/

0

I have found an alternate solution that avoids DNS CNAME and CloudFront costs: make it all inside the NGINX server. It's a great solution, optimized with proxy cache. Here's the solution: https://stackoverflow.com/questions/44639182/nginx-proxy-amazon-s3-resources/44749584 Hope this helps as it helped me! :)

3
  • 1
    CloudFront is a CDN with servers all over the world. Comparing that to going through a single server which may be on the other side of the world for some users is a bit weird.
    – jcaron
    Nov 9 '20 at 13:26
  • With big projects, yes, but with a small project it's enough for me
    – Ommadawn
    Nov 9 '20 at 15:45
  • Nginx is the single point of failure though. All the other solutions are fully Redundant, Highly Available and support parallel throughput. If you go down the Nginx path you can just as well store the files there and not bother with S3 at all.
    – MLu
    Nov 9 '20 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.