Securing Your S3 Buckets: Preventing Unauthorized Access with CloudFront OAI
In today’s cloud computing world, keeping data safe is crucial. AWS does a great job storing data in its data centers, but it’s up to us to set up who can access it.
Many companies use Amazon S3 buckets. These offer a way to store lots of data through Amazon Web Services (AWS). But making sure your S3 buckets are secure is important. Even a minor error can allow unauthorized access to your private information.
This blog post explores how to prevent unauthorized access to your S3 buckets using CloudFront Origin Access Identity (OAI).
Understanding the Issue
By default, S3 buckets are private. However, when hosting a static frontend website, it’s common to grant public access to your bucket and enable the static web hosting property. Even with security policies applied to your bucket objects, a small mistake or incorrect configuration can lead to unauthorized access to sensitive data.
This is where CloudFront Origin Access Identity (OAI) comes to the rescue!
CloudFront Origin Access Identity
AWS CloudFront is a content delivery network (CDN) service that can be used to distribute content globally while providing a security layer. CloudFront OAI is a feature that helps secure your S3 buckets by allowing you to restrict access to your data to only CloudFront distributes.
CloudFront OAI does this by updating the bucket policy to only allow access from CloudFront.
Let’s look into how we can configure CloudFront on top of our S3 bucket.
Setup S3 bucket
Create an S3 bucket with block all public access enabled. Additionally, by default bucket ACLs, are disabled. Upload all your front-end static content into your bucket.
Note: If you already have a static frontend hosted on S3, make sure to disable the static website hosting property since we will leverage CloudFront. Additionally, remove any existing bucket policies, and disable public access to your bucket I already have a bucket with my web files uploaded. If I try accessing my objects directly, am getting access denied. Now let’s see on how to leverage CloudFront to securely access our objects.
Log into the AWS management console then in the search bar search for CloudFront then select it.
On the left side of CloudFront UI, select distributions, then click create distributions.
For the Origin domain, choose your S3 bucket, name will be updated automatically.
Let’s configure the origin access control settings.
Select legacy access settings then select the drop-down button to select Origin Access Identity, if you don’t have one click Create. Then click the radio button for Yes update bucket policy. This will automatically update your bucket policy.
Leave the remaining settings as default.
Keep the default cache behaviour settings.
Functional associations will be kept as default.
Under Web Application Firewall (WAF), enable WAF for additional security if needed; otherwise, select do not enable security protections.
Under settings, add index.html for the default root object and click create distribution.
Our CloudFront distribution policy has been successfully created as we can see.
Additionally, we can see our bucket policy updated to only allow access from CloudFront.
Retrieve your CloudFront distribution domain name and verify your website’s availability.
You can also assess the security of your index.html object by accessing its object URL. We can see access denied.
This indicates that your bucket is exposed only to your created CloudFront distribution and cannot be accessed directly, which ensures any unauthorized or direct access to your S3 bucket is denied.
This brings us to the end of this demo. Always make sure you clean resources to avoid surprise bills.
Conclusion
To wrap up, now know how to use Amazon S3 to host static websites set up CloudFront to deliver content, and keep sensitive data safe in your S3 bucket with CloudFront Origin Access Identity (OAI). When you put these methods into action, you can stop direct access to your content and make content delivery much faster. This way, you keep your data secure and give your users a smooth and quick experience.
Thanks for reading and stay tuned for more.
If you have any questions concerning this article or have an AWS project that requires our assistance, please reach out to us by leaving a comment below or email us at [email protected].
Thank you!