1

This is a rewrite of my original post. I still banging my head trying to figure out how to get a custom client (Windows service that only speaks HTTP, does not support HTTPS) to upload files to Amazon AWS S3 buckets via an Apache 2.4 proxy. Since the client doesn't support HTTPS, I want it to access arbitrary S3 buckets via HTTP and have the Apache proxy transparently use HTTPS between itself and the S3 buckets, e.g. HTTPS://bucket-name.s3-aws-region.amazonaws.com, to handle the file uploads. A simple rewrite has so far not worked. This wouldn't be a redirect (mod_proxy [R,L] flags) since I don't want to redirect the client to the HTTPS URL since it can't do SSL.

I can do this for a single bucket using a reverse proxy, but I don't see how to use a reverse proxy for an arbitrary number of unspecified buckets since it's the domains that matter in the ProxyPass and ProxyPassReverse settings.

Is what I'm trying to do even possible? It feels like it should be...

  • Can you give more detail as to your setup please - specifically, is this only to apply to file uploads to S3? – BE77Y Jan 29 '15 at 16:23
  • I was intentionally vague about the setup because I wanted to avoid unnecessary assumptions about how to solve this. For this particular situation, it is a one-off to be able to upload files from an in-house service (call it UploadSvc) to any of a number of S3 buckets we already have or may create. UploadSvc only speaks HTTP but we want the traffic to be over HTTPS when it leaves our network. – Justin Lloyd Jan 29 '15 at 16:26
2

This is absolutely possible, and does not require Apache on the proxy server to have an SSL key as you say (as the interaction with that server is carried out via HTTP).

You essentially just need to use a fairly basic proxy configuration similar to the following as an example:

<VirtualHost *:80>
    ServerName yourintendedname.com
    SSLProxyEngine On
    ProxyPreserveHost on
    ProxyPass / https://upstreamserver.com:443/
    ProxyPassReverse / https://upstreamserver.com:443/
</VirtualHost>

The above configuration takes all traffic requested traffic to yourintendedname.com and passes the requested URI as-is to upstreamserver.com via https.

Now, the issue you will potentially note (and why I requested more detail in your question) is that the fact that the requested URI will be passed up to the server to be proxied to as-is may well cause problems. You alone will be able to figure out a solution to this for your individual circumstances.

  • Maybe I'm just being dense, but the problem as I see it is that the target URLs vary due to all of the different S3 bucket names, so we can't just reverse proxy a single URL, i.e. http://<bucket>.s3-<aws-region>.amazonaws.com. – Justin Lloyd Jan 29 '15 at 16:38
  • This is an excellent example of a possible complication which is why I requested more detail! – BE77Y Jan 29 '15 at 16:39
  • Sorry, it was implicit when I mentioned S3 but I guess I assumed it was also implicit that there could be multiple S3 buckets and thus variable URLs. My apologies for the confusion. – Justin Lloyd Jan 29 '15 at 16:41
  • I myself may be missing something but in that case, I don't see an obvious solution - if one exists it must be significantly more cunning than the above I'm afraid. – BE77Y Jan 29 '15 at 16:42
  • That's what I was afraid of, but I wasn't sure if I was just being really dumb or if this was indeed more complicated than I thought it would be. – Justin Lloyd Jan 29 '15 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.