Serving private S3 content through CloudFront

README.md

@@ -86,6 +86,25 @@ distribution:
               viewer-request: arn:aws:lambda:us-east-1:123:function:myFunc:version # lambda ARN including version
 ```
 
+#### Private S3 Content
+
+To restrict access to content that you serve from S3 you can mark as `private` your S3 origins:
+
+```yml
+# serverless.yml
+
+distribution:
+  component: '@serverless/aws-cloudfront'
+  inputs:
+    origins:
+      - url: https://my-private-bucket.s3.amazonaws.com
+        private: true
+```
+
+A bucket policy will be added that grants CloudFront with access to the bucket objects. Note that it doesn't remove any existing permissions on the bucket. If users currently have permission to access the files in your bucket using Amazon S3 URLs you will need to manually remove those.
+
+This is documented in more detail here: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
+
 ### 4. Deploy
 
 ```console

__mocks__/aws-sdk.js

@@ -19,20 +19,38 @@ const mockGetDistributionConfigPromise = promisifyMock(mockGetDistributionConfig
 const mockDeleteDistribution = jest.fn()
 const mockDeleteDistributionPromise = promisifyMock(mockDeleteDistribution)
 
+const mockCreateCloudFrontOriginAccessIdentity = jest.fn()
+const mockCreateCloudFrontOriginAccessIdentityPromise = promisifyMock(
+  mockCreateCloudFrontOriginAccessIdentity
+)
+
+const mockPutBucketPolicy = jest.fn()
+const mockPutBucketPolicyPromise = promisifyMock(mockPutBucketPolicy)
+
 module.exports = {
   mockCreateDistribution,
   mockUpdateDistribution,
   mockGetDistributionConfig,
   mockDeleteDistribution,
+  mockCreateCloudFrontOriginAccessIdentity,
+  mockPutBucketPolicy,
+
+  mockPutBucketPolicyPromise,
   mockCreateDistributionPromise,
   mockUpdateDistributionPromise,
   mockGetDistributionConfigPromise,
   mockDeleteDistributionPromise,
+  mockCreateCloudFrontOriginAccessIdentityPromise,
 
   CloudFront: jest.fn(() => ({
     createDistribution: mockCreateDistribution,
     updateDistribution: mockUpdateDistribution,
     getDistributionConfig: mockGetDistributionConfig,
-    deleteDistribution: mockDeleteDistribution
+    deleteDistribution: mockDeleteDistribution,
+    createCloudFrontOriginAccessIdentity: mockCreateCloudFrontOriginAccessIdentity
+  })),
+
+  S3: jest.fn(() => ({
+    putBucketPolicy: mockPutBucketPolicy
   }))
 }

__tests__/__snapshots__/custom-url-origin.test.js.snap

@@ -7,6 +7,10 @@ Object {
       "Items": Array [],
       "Quantity": 0,
     },
+    "CacheBehaviors": Object {
+      "Items": Array [],
+      "Quantity": 0,
+    },
     "CallerReference": "1566599541192",
     "Comment": "",
     "DefaultCacheBehavior": Object {
@@ -93,6 +97,10 @@ Object {
 exports[`Input origin as a custom url updates distribution 1`] = `
 Object {
   "DistributionConfig": Object {
+    "CacheBehaviors": Object {
+      "Items": Array [],
+      "Quantity": 0,
+    },
     "DefaultCacheBehavior": Object {
       "AllowedMethods": Object {
         "CachedMethods": Object {

__tests__/__snapshots__/s3-origin.test.js.snap

@@ -1,12 +1,184 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`Input origin as an S3 bucket url creates distribution with S3 origin 1`] = `
+exports[`S3 origins When origin is an S3 URL only accessible via CloudFront creates distribution 1`] = `
 Object {
   "DistributionConfig": Object {
     "Aliases": Object {
       "Items": Array [],
       "Quantity": 0,
     },
+    "CacheBehaviors": Object {
+      "Items": Array [],
+      "Quantity": 0,
+    },
+    "CallerReference": "1566599541192",
+    "Comment": "",
+    "DefaultCacheBehavior": Object {
+      "AllowedMethods": Object {
+        "CachedMethods": Object {
+          "Items": Array [
+            "HEAD",
+            "GET",
+          ],
+          "Quantity": 2,
+        },
+        "Items": Array [
+          "HEAD",
+          "GET",
+        ],
+        "Quantity": 2,
+      },
+      "Compress": false,
+      "DefaultTTL": 86400,
+      "FieldLevelEncryptionId": "",
+      "ForwardedValues": Object {
+        "Cookies": Object {
+          "Forward": "none",
+        },
+        "Headers": Object {
+          "Items": Array [],
+          "Quantity": 0,
+        },
+        "QueryString": false,
+        "QueryStringCacheKeys": Object {
+          "Items": Array [],
+          "Quantity": 0,
+        },
+      },
+      "LambdaFunctionAssociations": Object {
+        "Items": Array [],
+        "Quantity": 0,
+      },
+      "MaxTTL": 31536000,
+      "MinTTL": 0,
+      "SmoothStreaming": false,
+      "TargetOriginId": "mybucket",
+      "TrustedSigners": Object {
+        "Enabled": false,
+        "Items": Array [],
+        "Quantity": 0,
+      },
+      "ViewerProtocolPolicy": "redirect-to-https",
+    },
+    "Enabled": true,
+    "HttpVersion": "http2",
+    "Origins": Object {
+      "Items": Array [
+        Object {
+          "CustomHeaders": Object {
+            "Items": Array [],
+            "Quantity": 0,
+          },
+          "DomainName": "mybucket.s3.amazonaws.com",
+          "Id": "mybucket",
+          "OriginPath": "",
+          "S3OriginConfig": Object {
+            "OriginAccessIdentity": "origin-access-identity/cloudfront/access-identity-xyz",
+          },
+        },
+      ],
+      "Quantity": 1,
+    },
+    "PriceClass": "PriceClass_All",
+  },
+}
+`;
+
+exports[`S3 origins When origin is an S3 URL only accessible via CloudFront updates distribution 1`] = `
+Object {
+  "DistributionConfig": Object {
+    "Aliases": Object {
+      "Items": Array [],
+      "Quantity": 0,
+    },
+    "CacheBehaviors": Object {
+      "Items": Array [],
+      "Quantity": 0,
+    },
+    "CallerReference": "1566599541192",
+    "Comment": "",
+    "DefaultCacheBehavior": Object {
+      "AllowedMethods": Object {
+        "CachedMethods": Object {
+          "Items": Array [
+            "HEAD",
+            "GET",
+          ],
+          "Quantity": 2,
+        },
+        "Items": Array [
+          "HEAD",
+          "GET",
+        ],
+        "Quantity": 2,
+      },
+      "Compress": false,
+      "DefaultTTL": 86400,
+      "FieldLevelEncryptionId": "",
+      "ForwardedValues": Object {
+        "Cookies": Object {
+          "Forward": "none",
+        },
+        "Headers": Object {
+          "Items": Array [],
+          "Quantity": 0,
+        },
+        "QueryString": false,
+        "QueryStringCacheKeys": Object {
+          "Items": Array [],
+          "Quantity": 0,
+        },
+      },
+      "LambdaFunctionAssociations": Object {
+        "Items": Array [],
+        "Quantity": 0,
+      },
+      "MaxTTL": 31536000,
+      "MinTTL": 0,
+      "SmoothStreaming": false,
+      "TargetOriginId": "mybucket",
+      "TrustedSigners": Object {
+        "Enabled": false,
+        "Items": Array [],
+        "Quantity": 0,
+      },
+      "ViewerProtocolPolicy": "redirect-to-https",
+    },
+    "Enabled": true,
+    "HttpVersion": "http2",
+    "Origins": Object {
+      "Items": Array [
+        Object {
+          "CustomHeaders": Object {
+            "Items": Array [],
+            "Quantity": 0,
+          },
+          "DomainName": "mybucket.s3.amazonaws.com",
+          "Id": "mybucket",
+          "OriginPath": "",
+          "S3OriginConfig": Object {
+            "OriginAccessIdentity": "origin-access-identity/cloudfront/access-identity-xyz",
+          },
+        },
+      ],
+      "Quantity": 1,
+    },
+    "PriceClass": "PriceClass_All",
+  },
+}
+`;
+
+exports[`S3 origins When origin is an S3 bucket URL creates distribution 1`] = `
+Object {
+  "DistributionConfig": Object {
+    "Aliases": Object {
+      "Items": Array [],
+      "Quantity": 0,
+    },
+    "CacheBehaviors": Object {
+      "Items": Array [],
+      "Quantity": 0,
+    },
     "CallerReference": "1566599541192",
     "Comment": "",
     "DefaultCacheBehavior": Object {
@@ -80,9 +252,13 @@ Object {
 }
 `;
 
-exports[`Input origin as an S3 bucket url updates distribution 1`] = `
+exports[`S3 origins When origin is an S3 bucket URL updates distribution 1`] = `
 Object {
   "DistributionConfig": Object {
+    "CacheBehaviors": Object {
+      "Items": Array [],
+      "Quantity": 0,
+    },
     "DefaultCacheBehavior": Object {
       "AllowedMethods": Object {
         "CachedMethods": Object {