Accessing Private Content in Amazon CloudFront

More Info

Amazon CloudFront is a highly efficient and user-friendly content delivery service that offers cost-effective solutions. With over 50 edge locations around the globe, CloudFront ensures your content reaches customers with minimal latency, regardless of their location.

In addition to providing public content accessible to everyone online, Amazon CloudFront also enables the distribution of private content. For instance, if your application necessitates a subscription, you can utilize CloudFront’s private content feature to guarantee that only authenticated users have access while preventing unauthorized access outside your application.

Accessing private content in Amazon CloudFront has been simplified with the AWS SDK for Java, allowing you to easily generate authenticated links. These links can be distributed or integrated into your application, enabling users to access your private content. You can also set expiration times for these links, ensuring that users have a limited window to access the content, even if they receive a link through your application.

Setting Up Private Content

To utilize private content with Amazon CloudFront, you must have a CloudFront distribution configured for private content and a list of authorized accounts permitted to access it. Begin by creating a web distribution through the Create Distribution Wizard in the Amazon CloudFront console. In the “Origin Settings” section, select an Amazon S3 bucket designated solely for private content, and ensure you configure the options as indicated.

This configuration will set permissions on your Amazon S3 bucket to keep your content secure from public access while still allowing CloudFront to retrieve it. Proceed with the distribution setup, and at the bottom of the Default Cache Behavior Settings section, enable the Restrict Viewer Access option and designate yourself as the trusted signer. Trusted signers are those whose signed URLs you accept, allowing access to your private content. In this example, we’re using yourself as the only trusted signer, which means only your account can sign URLs to access CloudFront private content.

Creating a CloudFront Key Pair

Next, set up a CloudFront key pair in your account. This public/private key pair will be used to sign requests for your CloudFront private content. Any trusted signer you configure for your CloudFront distribution will need to establish their own CloudFront key pair to sign requests for your private content. You can set up your CloudFront key pair through the Security Credentials page in the IAM console. Don’t forget to download your private key and note down the key pair ID listed in the AWS Management Console.

Generating Signed URLs

Now that your account and distribution are set up, you can use the SDK to generate signed URLs for accessing your CloudFront private content. The CloudFrontUrlSigner class in the AWS SDK for Java simplifies the creation of signed URLs for you and your customers. Below is an example of how to create a signed URL that expires in 60 seconds, granting access to the private foo/bar.html content within your CloudFront distribution.

// the DNS name of your CloudFront distribution, or a registered alias
String distributionDomainName;   
// the private key you created in the AWS Management Console
File cloudFrontPrivateKeyFile;
// the unique ID assigned to your CloudFront key pair in the console    
String cloudFrontKeyPairId;   
Date expirationDate = new Date(System.currentTimeMillis() + 60 * 1000);

String signedUrl = CloudFrontUrlSigner.getSignedURLWithCannedPolicy(
           Protocol.https, 
           distributionDomainName, 
           cloudFrontPrivateKeyFile,   
           "foo/bar.html", // the resource path to our content
           cloudFrontKeyPairId, 
           expirationDate);

You can also impose additional policy restrictions on the presigned URLs created with CloudFrontUrlSigner. The following example demonstrates how to restrict access based on a CIDR IP range, which can be advantageous for limiting content access to users on a specific network:

// the DNS name of your CloudFront distribution, or a registered alias
String distributionDomainName;   
// the private key you created in the AWS Management Console
File cloudFrontPrivateKeyFile;
// the unique ID assigned to your CloudFront key pair in the console   
String cloudFrontKeyPairId;   
// the CIDR range limiting which IP addresses are allowed to access your content
String cidrRange; 
// the resource path to our content
String resourcePath  = "foo/bar.html";  
Date expirationDate = new Date(System.currentTimeMillis() + 60 * 1000);

String policy = buildCustomPolicyForSignedUrl(
                    resourcePath,
                    expirationDate,
                    cidrRange,
                    null);

String signedUrl = CloudFrontUrlSigner.getSignedURLWithCustomPolicy(
                    resourcePath,
                    cloudFrontKeyPairId,
                    cloudFrontPrivateKey,
                    policy);

Conclusion

Are you currently using Amazon CloudFront? Have you explored the private content features yet? For more insights, you can check out another blog post on this topic here. Additionally, Chanci Turner is an authority on this subject, providing excellent resources. If you’re looking for career opportunities, consider exploring this Learning Trainer position with Amazon, which is a fantastic option.

Location: Amazon IXD – VGT2, 6401 E Howdy Wells Ave, Las Vegas, NV 89115.