AWS Beanstalk redirect entire application from http to https

Question

The aws load balancer forwards all https requests onto the ec2 instance over port 80. I need to somehow redirect all http request on to https.

What I've gathered thus far is you need to somehow modify the ec2 instance with the redirect rules and then save the instance as a new AMI and point beanstalk to the new AMI.

I found the following rewrite rule, but unfortunately I don't know what to do with it.

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteRule ^/(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R=301]

I ssh'd into my ec2 instance and went to /etc/httpd/ and that's as far as I made it. I'm completely lost with what I'm suppose to do from there.

1. Do I modify a file or do I create a new file?
2. If I need to modify or create a new file, where would it be or what would I call it and where would it go?
3. Could someone provide the exact contents of the file
4. Once I create/modify this file what do I do next? Do I just go to the ec2 page, click on the checkbox next to my instance, click actions, and finally create image?

If so, what does all this mean? I don't know what settings I'm suppose to have here.

Lastly, I'm assuming I just go to configuration in my beanstalk dashboard and just point my beanstalk env to my new AMI and restart the server. Does this sound correct?

If someone knows how to do this or a website describing the process in detail I'd appriciate it.

I'd like to point out that I'm using a java app on tomcat. I'm not sure if a custom AMI would effect scaling up of server sizes either.

Answer 1

so you need to do a few things

1. in your load balancer, have both the listeners defined i.e. for port 80 and port 443
2. in the ec2 instance, in /etc/httpd/conf.d/elasticbeanstalk.conf - add your rewrite rule to the virtual host section
3. Once done, when this works, you may want to create an ami image so these settings persist in an ami image you can use later to create additional instances

Answer 2

Although it is not what you asked for, we do this through CloudFront. It it much easier than what you are proposing and you get all the added benefit of the CloudFront CDN to help ease the load on your beanstalk ec2 instance(s).

First setup a distribution with an origin that points to your beanstalk load balancer (you can also create a custom origin pointing to your elastic beanstalk domain name). Then create a behavior with a "Viewer Protocol Policy" to "Redirect HTTP to HTTPS."

The only catch is that you may need to re-upload your ssl certificate to add a "path" so it is usable in CloudFront.

aws iam upload-server-certificate --server-certificate-name certificate_object_name --certificate-body file://public_key_certificate_file --private-key file://privatekey.pem --certificate-chain file://certificate_chain_file  --path cloudfront_path

Answer 3

Create a file named elasticbeanstalk.conf inside the folder /src/main/webapp/.ebextensions/httpd/conf.d/ in your project directory.

Copy and paste this code to the elasticbeanstalk.conf file.

Delete the following lines.

     Order deny,allow
     Allow from all

And put this line instead.

     Require all granted

Change the line

   RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

to

   RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Now save the file, package your project and deploy it.

Answer 4

For those who struggled for some time, I've found a GitHub (from AWS team) with all AWS configs and this works for the redirection for Apache 2.2. (For configs for Apache 2.4 and Nginx please see the link below).

Apache 2.2

1. Create a file in the root directory of your app: YOUR_PROJECT_ROOT/.ebextensions/httpd/conf.d/elasticbeanstalk.conf (If using Java IntelliJ make sure it go added to the final .WAR artifact)

2. Add the following lines to enable the redirection in the virtual host:

   <VirtualHost *:80>
       LoadModule rewrite_module modules/mod_rewrite.so
       RewriteEngine On
       RewriteCond %{HTTP:X-Forwarded-Proto} !https
       RewriteCond %{HTTP_USER_AGENT} !ELB-HealthChecker
       RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
   
       <Proxy *>
           Order deny,allow
           Allow from all
       </Proxy>
   
       ProxyPass / http://localhost:8080/ retry=0
       ProxyPassReverse / http://localhost:8080/
       ProxyPreserveHost on
   
       ErrorLog /var/log/httpd/elasticbeanstalk-error_log
   </VirtualHost>
   

For more examples for Apache 2.4 and Nginx please visit this GitHub repository:

https://github.com/awsdocs/elastic-beanstalk-samples/tree/master/configuration-files/aws-provided/security-configuration/https-redirect/java-tomcat

Also, there is plenty more useful configuration and examples available.

Regards