Serving private S3 content through CloudFront

[danielcondemarin]

Motivation

I want to serve my private S3 assets through CloudFront. That is users shouldn't be able to access S3 objects directly via S3 urls etc.

Proposal

Update component api to support this use case:

# serverless.yml
distribution:
  component: '@serverless/aws-cloudfront'
  inputs:
    origins:
      - url: https://mybucket.s3.amazonaws.com
        private: true

By setting the private flag to true the component will detect this and:

• Provision a CloudFront origin access identity
• Set S3OriginConfig to use the access identity for any private S3 origins
• Update bucket policy to allow access from the identity created above (https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html#example-bucket-policies-use-case-6)

The approach is described here in more detail: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html

[eahefnawy]

Thanks @danielcondemarin ... I like that single boolean input.

[danielcondemarin]

@eahefnawy This is ready to review now 👍

[eahefnawy]

Thanks @danielcondemarin ... LG2M 🎉