amazon-web-services - 将 SSL 证书连接到 CloudFormation 中的 CloudFront CDN

Question

到目前为止，我已经用它来创建资源了。

"staticFileBucketPolicy": {
  "Type": "AWS::S3::BucketPolicy",
  "DependsOn": "staticFileBucket",
  "Properties": {
    "Bucket": { "Ref": "staticFileBucket" },
    "PolicyDocument": {
      "Version": "2012-10-17",
      "Statement": [{
        "Sid": "AddPerm",
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": { "Fn::Join" : ["", ["arn:aws:s3:::", { "Ref" : "staticFileBucket" } , "/*" ]]}
      }]
    }
  }
},

"certificate": {
  "Type": "AWS::CertificateManager::Certificate",
  "Properties": {
    "DomainName": { "Ref": "Domain" },
    "SubjectAlternativeNames": [
      { "Fn::Join": ["", [ "*.", { "Ref": "Domain" } ]] }
    ],
    "DomainValidationOptions" : [{
      "DomainName": { "Ref": "Domain" },
      "ValidationDomain" : { "Ref": "Domain" }
    }],
    "Tags": [{
      "Key": "CloudFormationStack",
      "Value": { "Ref": "AWS::StackName" }
    }]
  }
},

"staticCDN": {
  "Type": "AWS::CloudFront::Distribution",
  "DependsOn": "staticFileBucket",
  "Properties": {
    "DistributionConfig": {
      "Comment": "CDN for Sagely static files.",
      "Enabled": true,
      "DefaultRootObject": "index.html",
      "DefaultCacheBehavior": {
        "AllowedMethods": [ "HEAD", "GET", "OPTIONS" ],
        "TargetOriginId": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" } ]] },
        "ForwardedValues": {
          "QueryString": false,
          "Headers": [ "Access-Control-Request-Headers", "Access-Control-Request-Method", "Origin" ]
        },
        "ViewerProtocolPolicy": "redirect-to-https"
      },
      "Origins": [{
        "DomainName": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" }, ".s3.amazonaws.com" ]] },
        "Id": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" } ]] },
        "S3OriginConfig": { }
      }]
    }
  }
},

CDN 通过我的自定义域运行。但是如何将SSL证书连接到CDN呢？

Answer 1

您想要一个 ViewerCertificate您的属性(property) DistributionConfig 。它应该是这样的:

  "ViewerCertificate": {
    "AcmCertificateArn": { "Ref": "certificate" },
    "SslSupportMethod": "sni-only"
  }

根据您的代码，可能需要将您的 staticCDN 更新为:

"staticCDN": {
  "Type": "AWS::CloudFront::Distribution",
  "DependsOn": "staticFileBucket",
  "Properties": {
    "DistributionConfig": {
      "Comment": "CDN for Sagely static files.",
      "Enabled": true,
      "DefaultRootObject": "index.html",
      "DefaultCacheBehavior": {
        "AllowedMethods": [ "HEAD", "GET", "OPTIONS" ],
        "TargetOriginId": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" } ]] },
        "ForwardedValues": {
          "QueryString": false,
          "Headers": [ "Access-Control-Request-Headers", "Access-Control-Request-Method", "Origin" ]
        },
        "ViewerProtocolPolicy": "redirect-to-https"
      },
      "Origins": [{
        "DomainName": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" }, ".s3.amazonaws.com" ]] },
        "Id": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" } ]] },
        "S3OriginConfig": { }
      }],
      "ViewerCertificate": {
        "AcmCertificateArn": { "Ref": "certificate" },
        "SslSupportMethod": "sni-only"
      }
    }
  }
},