ALB rewrite to S3 get with auth^n

Question

Using the new [ALB rewrite header / URL functionality](https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-url-and-host-header-rewrite-with-aws-application-load-balancers/), would it be possible to get ALB to front an S3 bucket which has a different name to the ALB CNAME?

Historically, we had to name the S3 bucket with the same CNAME as the request to the ALB for getting objects from S3 through the ALB. This requires a VPC Endpoint in the VPC where the ALB is located.

This architecture is [documented here](https://aws.amazon.com/blogs/networking-and-content-delivery/hosting-internal-https-static-websites-with-alb-s3-and-privatelink/)

In my use case, the ALB does auth^n with OIDC or Cognito and the S3 bucket only allows access through an S3 endpoint in my VPC.

I am interested to know whether this can now be done with URL / header rewrite, and if so, how it would be implemented. This would allow S3 buckets with any name to be privately surfaced through an ALB.

Leo K · Accepted Answer

Yes, the new header rewrite ability of the ALB does allow you to overwrite the entire Host header value with anything you want. When you overwrite it with the virtual-hosted DNS name of the bucket, of the form `BUCKETNAME.s3.REGIONCODE.amazonaws.com`, the VPC interface endpoint should accept it and pass it to the S3 service, which should use it to identify the bucket to which to address the requests coming through the ALB.

If you want to use the same ALB to serve requests for multiple buckets, and using "example.com" as the sample name of your own DNS domain, you could create a wildcard TLS certificate for *.example.com in ACM and attach it to the ALB's HTTPS listener. In the listener rules, only accept requests with a Host header matching the regex pattern "`^[^.]+\.example\.com$`" and send them to the VPC endpoint's target group after OIDC authentication. In the transform rule, set "`^([^.]+)\.example\.com$`" as the pattern and "`$1.s3.REGIONCODE.amazonaws.com`" as the replacement value. Of course, replace "REGIONCODE" with the region in which your ALB and S3 buckets reside.

This way, all requests from the ALB to S3 buckets in the region will go to the bucket with the name matching the hostname prefix preceding ".example.com" in the DNS names with which the ALB is called. For example, requests for `mybucket1.example.com` would get sent to `mybucket1.s3.REGIONCODE.amazonaws.com`.

Gary Mclean · Answer

I have always fronted S3 buckets with OAC control as I feel it’s more secure as the S3 bucket doesn’t have to be public. You may find it cheaper this way also.

The bucket name doesn’t matter if using cloudfront.

ALB rewrite to S3 get with auth^n

Add your answer

Relevant content