Is there support for using CloudFront with an mTLS authenticated Custom Domain Name for APIGateway?

0

We're trying to put an mTLS authenticated APIGateway behind a Cloudfront distribution, but I can't find any resources online on how to do this. We have this type of thing setup with normal TLS and it works fine, but if we try to mirror our existing setup to use mTLS instead, it doesn't work. Is this setup supported, and how can we go about setting this up? Thanks

已提问 1 年前2426 查看次数
2 回答
2

Probably cannot be used given the technical considerations of mTLS authentication.
In this configuration, HTTP requests specifying a client certificate are first requested to CloudFront.
Since there is no client authentication between the client and CloudFront, the specified client certificate is not used.
After that, it is possible to pass HTTP headers and body from CloudFront to API Gateway, but since it does not inherit the client certificate specified in the previous step, an authentication error should occur here.

profile picture
专家
已回答 1 年前
profile picture
专家
已审核 1 年前
2

I don't think that CloudFront supports this use-case. This is due to the fact that CloudFront handles the TLS termination and doesn't support pass-through to API Gateway or other downstream services. If you would like to use mTLS, you should point your Route 53 domain name directly to API Gateway, configure a custom domain, disable the default endpoint, and add AWS WAF to the API. Additionally, it's worth noting that mTLS is not supported for Edge-optimized APIs and can be used with Regional APIs only​​.

I would also suggest you reading the following article: Propagating valid mTLS client certificate identity to downstream services using Amazon API Gateway

profile picture
专家
已回答 1 年前
profile picture
专家
已审核 1 年前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则