将SSL证书连接到CloudFormation中的CloudFront CDN [英] Connecting a SSL cert to a CloudFront CDN in CloudFormation

问题描述

到目前为止，我具有创建资源的功能。

So far I have this to create the resources.

"staticFileBucketPolicy": {
  "Type": "AWS::S3::BucketPolicy",
  "DependsOn": "staticFileBucket",
  "Properties": {
    "Bucket": { "Ref": "staticFileBucket" },
    "PolicyDocument": {
      "Version": "2012-10-17",
      "Statement": [{
        "Sid": "AddPerm",
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": { "Fn::Join" : ["", ["arn:aws:s3:::", { "Ref" : "staticFileBucket" } , "/*" ]]}
      }]
    }
  }
},

"certificate": {
  "Type": "AWS::CertificateManager::Certificate",
  "Properties": {
    "DomainName": { "Ref": "Domain" },
    "SubjectAlternativeNames": [
      { "Fn::Join": ["", [ "*.", { "Ref": "Domain" } ]] }
    ],
    "DomainValidationOptions" : [{
      "DomainName": { "Ref": "Domain" },
      "ValidationDomain" : { "Ref": "Domain" }
    }],
    "Tags": [{
      "Key": "CloudFormationStack",
      "Value": { "Ref": "AWS::StackName" }
    }]
  }
},

"staticCDN": {
  "Type": "AWS::CloudFront::Distribution",
  "DependsOn": "staticFileBucket",
  "Properties": {
    "DistributionConfig": {
      "Comment": "CDN for Sagely static files.",
      "Enabled": true,
      "DefaultRootObject": "index.html",
      "DefaultCacheBehavior": {
        "AllowedMethods": [ "HEAD", "GET", "OPTIONS" ],
        "TargetOriginId": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" } ]] },
        "ForwardedValues": {
          "QueryString": false,
          "Headers": [ "Access-Control-Request-Headers", "Access-Control-Request-Method", "Origin" ]
        },
        "ViewerProtocolPolicy": "redirect-to-https"
      },
      "Origins": [{
        "DomainName": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" }, ".s3.amazonaws.com" ]] },
        "Id": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" } ]] },
        "S3OriginConfig": { }
      }]
    }
  }
},

CDN通过我的自定义域工作。但是，如何将SSL证书连接到CDN？

The CDN works through my custom domain. But how to I connect the SSL certificate to the CDN?

推荐答案

您要使用 ViewerCertificate 属性位于您的 DistributionConfig 。它应该是这样的：

You want to have a ViewerCertificate property on your DistributionConfig. It should be something like:

  "ViewerCertificate": {
    "AcmCertificateArn": { "Ref": "certificate" },
    "SslSupportMethod": "sni-only"
  }

根据您的代码，可能想将 staticCDN 更新为以下内容：

Based on your code, probably want to update your staticCDN to something like:

"staticCDN": {
  "Type": "AWS::CloudFront::Distribution",
  "DependsOn": "staticFileBucket",
  "Properties": {
    "DistributionConfig": {
      "Comment": "CDN for Sagely static files.",
      "Enabled": true,
      "DefaultRootObject": "index.html",
      "DefaultCacheBehavior": {
        "AllowedMethods": [ "HEAD", "GET", "OPTIONS" ],
        "TargetOriginId": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" } ]] },
        "ForwardedValues": {
          "QueryString": false,
          "Headers": [ "Access-Control-Request-Headers", "Access-Control-Request-Method", "Origin" ]
        },
        "ViewerProtocolPolicy": "redirect-to-https"
      },
      "Origins": [{
        "DomainName": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" }, ".s3.amazonaws.com" ]] },
        "Id": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" } ]] },
        "S3OriginConfig": { }
      }],
      "ViewerCertificate": {
        "AcmCertificateArn": { "Ref": "certificate" },
        "SslSupportMethod": "sni-only"
      }
    }
  }
},

这篇关于将SSL证书连接到CloudFormation中的CloudFront CDN的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！