Cloudfront edge s3 bucket password protected

[s0enke]

superseeds #12

Vision / Story

Static website hosting is still a thing. And often, we want to protect our content e.g. with a password, for example when a website should not yet be public. While S3 provides a way to host static websites, it unfortunately offers no possibility to protect these websites with e.g. HTTP Basic Auth.
This CloudFormation template utilizes CloudFront with Origin Access Identity and Lambda@Edge to mimic a static website with basic auth password protection. Cognito userpools are used to manage users and credentials.

Target Conditions

S3 bucket not open to the world (no static website hosting option enabled)

Date	Current Condition	Obstacle	Next Experiment/Step	Expected Outcome	Learned
		I don't know how to protected an S3 bucket	Research		S3Auth.com: trust someone one the web? or self hosted.not serverless, no one-click CloudFront OIA to protected the S3 origin CloudFront signed cookies: no api call to generate the keys. Someone created this.
		Too many unknowns with API gateway	Create prototype with API Gateway PROXY integration and custom authorizers
		API Gateway PROXY INTEGRATION strips trailing slashes which makes it unusable in front of S3 buckets without static website hosting	try cloudfront and OIA

Fixed credentials (Basic Auth) are validated (no connection to Cognito yet)

(200 im OK fall und Object ausliefern und 401 im Non-Auth fall)

Date	Current Condition	Obstacle	Next Experiment/Step	Expected Outcome	Learned
	Fixed credentials (Basic Auth) are not validated	Authorization Header wird nicht durchgereicht zu CdnOrigin Lambda, weil S3 Origin es nicht erlaubt	Authorization in X-Authorization umschreiben in Viewer-Request funktion	Authorization can be passed this way to Origin Request function	If Lambda functions hang, there is a good possibility it’s OOM Python: How to pipe subprocess output to stdout Terraform bug non interactive: # S3 Backend Initialisation Error hashicorp/terraform#12971 The second parameter to callback is either the request or the response. CloudFront does somehow magically determinte if we send a request or a response
08-21	U/P is passed through to Origin Request function (which is allowed to make network calls e.g. to Cognito), but u/p is not yet validated	testing cycle for lambdas is too slow	write a simple makefile with lambda invoke for test calls to lambda@edge functions	development speeds up because cloudfront update is taken out of the test cycle	makefile plugin for intellij lambda tail and base64 decode onliner could be a blog post cloudformation deploy for idempotent stack updates
08-25	fixed U/P is not validated, target condition done

Cognito Connection (Infra via CloudFormation, and Implementation into Lambda)

Date	Current Condition	Obstacle	Next Experiment/Step	Expected Outcome	Learned
08-25	No Cognito at all	No Cognito userpool conneciton in Lambda@Edge	implement it	A manually created user in a manually created userpool can be authorized though the Lambda@edge function	ADMIN_NO_SRP_AUTH can be used for U/P authentication in Cognit AWS Region has to be set in Edge function, it is not the same as the CFN stack region
09-05	Manually created Cognito userpool integrated	Responses are cached at the Edge, so it apparently answers with a cached version even if not authorized	try to forbid caching at all	Forbidding caching will pass all requests to the Origin Request function	it is apparently not possible to add the Authorization header to the cache config: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/header-caching.html so that we cannot cache based on that header
09-05	Manually created Cognito userpool integrated, but no CFN		Create Userpool via CFN and connect it	it works	$$ to escape a $ in a Makefile
09-06	CFN Userpool integrated, Subdirectories do not work, e.g. /blah/ does not lookup /blah/index.html	CloudFront does not support IndexDocument, but only a Default root object (see this SA	it works

Parking Lot / TODO

• Reset Numbers of Lambda Versions
• redirects
• /blah/ should find /blah/index.html
• /blah should redirect to /blah/
• Cloudfront Cache settings: make sure no authenticated response is cached and leaked to unauthenticated clients
• Route53 optional
  • Custom SSL Cert
  • Subdomain to path mapping optionl
• Caching optional
• test framework, e.g. with behave
• Cont. Integration / Pipeline
• check if Makefile is still needed
• cleanup and unify JS code
• use JWT and set cookie so we don't have to make the Cognito API call every time
• remove debug logs
• proper logging, e.g. success / fail and proper logger usage

Next steps:

• Signup page for users to remove the password-passing problem. Users sign themselves up and the admin adds them to e.g. a group which is authorized
• Find a mode how to use Signed Cookies anyway? Would offload lambda