171 votes

Amazon Cloudfront with S3. Access Denied

If you're accessing the root of your CloudFront distribution, you need to set a default root object: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DefaultRootObject.html To ...
  • 1,980
98 votes
Accepted

Chrome S3 Cloudfront: No 'Access-Control-Allow-Origin' header on initial XHR request

You're making two requests for the same object, one from HTML, one from XHR. The second one fails, because Chrome uses the cached response from the first request, which has no Access-Control-Allow-...
96 votes

Amazon Cloudfront with S3. Access Denied

I've just had the same issue and while Kousha's answer does solve the problem for index.html in the root path, my problem was also with sub-directories as I used those combined with index.html to get &...
  • 1,111
42 votes
Accepted

No Cache-Control Header for files from AWS CloudFront with S3 Origin

I've hit a few pages in Google where you can set the Header in S3 for individual objects. That's really not a productive way to do it specially since in my case we are talking of several objects. ...
22 votes
Accepted

What is an Amazon Route53 "Alias" DNS record?

Route53 alias records is an own concept separate from DNS protocol record types: e.g. A is an address record and CNAME is a canonical name record. CNAME is the one that acts like an alias pointing to ...
  • 43.6k
18 votes

Amazon Cloudfront with S3. Access Denied

I had the same issue as @Cezz, though the solution would not work in my case. As soon as static website hosting is enabled for the bucket, it means users can access the content either via the ...
17 votes

Setting Access-Control-Allow-Origin on Cloudfront

Update: None of this is needed anymore as cloudfront now has proper support for this. Refer to: https://aws.amazon.com/about-aws/whats-new/2021/11/amazon-cloudfront-supports-cors-security-custom-http-...
13 votes
Accepted

Blue/Green deployments with CloudFront

Two Cloudfront Distributions Since AWS allows for overlap between wildcard alternate CNAMEs in the same AWS account, you can switch between two cloudfront distributions in the following manner: Use ...
  • 246
13 votes

HSTS on Amazon CloudFront from S3 origin

An update on this... HTTP response headers can now be customized via Lambda@edge functions. Please see http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-at-the-edge.html for ...
12 votes
Accepted

Configure AWS Cloudfront to log to S3 bucket in another AWS account

(Updated for future reference) Let's say your CloudFront distribution is in account 123456789012 with logging configured to a bucket your-logging-bucket in a different account. Create a S3 Bucket ...
  • 24k
11 votes
Accepted

Send custom Host header with CloudFront

Presumably, if the service on the ELB only answers to www.example.com then that's the hostname you're going to be pointing to CloudFront -- so, your solution is straightforward: in the Cache Behavior ...
11 votes
Accepted

Any drawbacks to AWS certificate manager wildcard certificates?

The upside is that it's very flexible. A wildcard cert allows you to add alternate domains in the future. The "normal" downsides to a star cert in general is they can be expensive and they create ...
  • 2,926
10 votes

Amazon Cloudfront with S3. Access Denied

In my case I was using multiple origins with "Path Pattern" Behaviors along with an Origin Path in my S3 bucket: Bad setup: CloudFront Behavior: /images/* -> My-S3-origin My-S3-origin: Origin Path: ...
10 votes

Blue/Green deployments with CloudFront

A bit late in the game here, but for anyone else looking for this. I believe this can be done using lambda@edge. Similar to A/B tests. https://docs.aws.amazon.com/lambda/latest/dg/lambda-edge.html. ...
  • 101
10 votes
Accepted

Does using CloudFront just to enable https make sense?

Yes using CloudFront is a legitimate way to enable https, and (as iBug pointed out in comments) can reduce your bandwidth egress costs a little. Another option is to use an application balancer, which ...
  • 30.8k
8 votes
Accepted

AWS CloudFront Default Root Object and subdirectories

When using an S3 bucket with the web site hosting feature (which enables index documents) you don't want to use the REST endpoint of the bucket, which is what CloudFront will offer you in the console. ...
8 votes
Accepted

openssl tool cannot get certificate from CloudFront, does anyone know why?

Adding -servername $domain fixed it: openssl s_client -connect $domain:443 -servername $domain 2> /dev/null < /dev/null | openssl x509 -noout -enddate Many thanks to Steffen Ullrich for the ...
8 votes
Accepted

HSTS on Amazon CloudFront from S3 origin

It is not currently possible, see https://forums.aws.amazon.com/thread.jspa?threadID=162252 for a discussion about it. Edit: Lambda@Edge has made it possible, see below.
  • 4,935
7 votes

Amazon Cloudfront with S3 Redirect

If you have this issue, check first when you configure the s3 bucket origin for the cloudfront, the autocomplete returns the s3 REST endpoint domain.amazonaws.com which return this ListBucketResult ...
7 votes
Accepted

Can I use CloudFront to serve a WordPress blog from the same domain, but a different server?

Yes, you can, if you set up the entire site to run behind CloudFront. You can then configure the default back-end origin service for the site, and carve out an exception to take a different path for /...
7 votes
Accepted

How do I route Cloudfront with multiple origins?

Create a second distribution. CloudFront can select the origin server based on path pattern matching only -- not the hostname, or other request parameters. http://docs.aws.amazon.com/...
7 votes
Accepted

AWS Cloudfront + Load Balancer, url changes from main domain to load balancer subdomain

This behavior likely results from the fact that by default CloudFront sets the Host: HTTP request header to the origin hostname, in this case elb.example.com. The application then presumably generates ...
7 votes

Should I use CloudFront in front of API/Web just because I want them on a single domain?

Given the choice between CloudFront and APi Gateway, CloudFront is the correct solution. API Gateway is not really suited for hosting an entire site, and there are complications related to large ...
7 votes
Accepted

Is there a need for WAF in static website front with REST API?

While WAF is primarily used to protect active websites, forms, APIs, etc there is sometimes need to use WAF in front of public static content as well. For example: How to Prevent Hotlinking by Using ...
  • 24k
6 votes
Accepted

How to store a Cloudfront custom error page in S3?

These are hints from https://web.archive.org/web/20140319123040/http://blog.celingest.com/en/2013/12/12/cloudfront-configuring-custom-error-pages/ You need to add another CloudFront origin pointing ...
  • 406
6 votes
Accepted

CloudFront Distribution for Origins in Multiple Regions

The distribution only requires you to provision a hostname as the origin. As long as that hostname happens to be able to route traffic to your origin, CloudFront doesn't need to have an awareness of ...
6 votes

Blue/Green deployments with CloudFront with equal proportion

You can't do this with CloudFront. tl;dr: your wildcard doesn't match hostnames where a specific, conflicting hostname is configured on another distribution. You created the wildcard alternative ...
6 votes

How can I use AWS CloudFront and API Gateway side by side for the same domain?

You can create a lambda function, setup API gateway, and then configure CloudFront to forward certain paths (e.g. /rest/*) to API gateway, and serve everything else from a S3 bucket. Here is a ...
6 votes
Accepted

Route53 subdomain not resolved with nslookup

In Amazon Hosted Zone you have different set of name servers than at your registrar. Domain Name: ADAMATAN.COM Registrar: Gandi SAS Name Server: NS-1193.AWSDNS-21.ORG Name Server: NS-1889.AWSDNS-44....
  • 43.6k
6 votes
Accepted

Setting "Object Caching" on CloudFront

It's not a bug. It's more like a case of imprecise descriptions of what the radio buttons actually mean. Use Origin Cache Headers actually means "Use origin cache headers constrained by standard ...

Only top scored, non community-wiki answers of a minimum length are eligible