1

What's the most straightforward way to implement an HTTPS wildcard redirect in AWS?

That is, I want fake13124.example.com (and any other such variations) to be redirected to example.com, but not realsub.example.com.

Is the AWS way to use a wildcard Route53 record and an ALB? Which is ~$150/yr for this?

There must be some more straightforward ways to do redirects than this?

Improve this question
2
  • Part of the cost will possibly be a wildcard certificate. There are generally more costly then a regular cert.
    – davidgo
    Nov 10, 2019 at 9:39
  • 1
    @davidgo there is no charge for a wildcard certificate from Amazon Certificate Manager. The $150 mentioned here is the cost of an ALB with minimal traffic. At ~$18/mo it's something of an underestimate.
    – Michael - sqlbot
    Nov 10, 2019 at 17:47

1 Answer 1

Reset to default
1

You can do this with Route 53, CloudFront, Amazon Certificate Manager, and S3.

Create an empty bucket in Amazon S3. Choose a region near the majority of your viewers. The bucket name does not matter.

Enable the web site hosting feature on the bucket. Note the web site endpoint hostname in the console. It will be in the general form of ${bucket}.s3-website.${region}.amazonaws com.

Define the following routing rule for the bucket.

<RoutingRules>
  <RoutingRule>
    <Condition>
      <KeyPrefixEquals></KeyPrefixEquals>
    </Condition>
    <Redirect>
      <Protocol>https</Protocol>
      <HostName>example.com</HostName>
      <ReplaceKeyWith></ReplaceKeyWith> <!-- remove this line to preserve the original path after redirect -->
    </Redirect>
  </RoutingRule>
</RoutingRules>

Requests arriving at the endpoint hostname for the bucket will be redirected to https://example.com. The path will not be preserved unless you remove the indicated line.

But you want other hostnames, specifically, most of *.example.com. And HTTPS.

Create a wildcard certificate in Amazon Certificate Manager (ACM) in us-east-1 for *.example.com. This needs to be us-east-1 regardless of the bucket region because we'll be using CloudFront and this is where CloudFront interconnects to ACM.

Create a new CloudFront distribution, using the new ACM certificate, using the bucket's web site endpoint hostname as a custom (not S3) origin server, and specifying *.example.com as the distribution's alternate domain name (CloudFront also calls this a "CNAME" even though that is not what this is). Choose redirect all HTTP requests to HTTPS.

Take the distribution's assigned dzzzexample.cloudfront.net hostname and use it to create an A record (for *.example.com, Alias = Yes) in Route 53 in the example.com hosted zone.

Wait for the distribution to go to the Deployed state.

Route 53 will respond to any *.example.com query not matching an other existing (or future) record in the zone with IP addresses of the nearest CloudFront edge.

CloudFront will redirect HTTP to HTTPS and will use the ACM certificate. CloudFront will send all requests to the bucket (unless it happens to have cached a response to a prior identical request) and S3 will always return a redirect response because <KeyPrefixEquals></KeyPrefixEquals> actually tells S3 to check whether the leftmost 0 characters in the requested object key is empty string, which it always will be, and redirect when that condition is true.

Assuming you're already using Route 53, the new recurring cost (assuming zero traffic) is $0. You'll be paying CloudFront per-request and bandwidth charges and S3 per-request charges, both of which should be negligible until you get into hundreds of thousands of requests.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .