aws-samples / cloudfront-signed-cookie-example Goto Github PK

This is a serverless web app protecting cached assets in CloudFront by using signed cookie.

Only public hosted zone is tested.

1. Note Domain name and Hosted zone ID.
2. Edit ./cdk.json

  "config": {
    "domainName": "Replace with Domain Name",
    "hostedZoneId": "Replace with Hosted zone ID",
    //
  }

1. Run the following command on your terminal.

KEYPAIR_NAME=signed-cookie
openssl genrsa -out ${KEYPAIR_NAME}.pem 2048
openssl rsa -pubout -in ${KEYPAIR_NAME}.pem -out ${KEYPAIR_NAME}_pub.pem
aws secretsmanager create-secret \
 --name ${KEYPAIR_NAME} \
 --secret-binary fileb://${KEYPAIR_NAME}.pem

Then you get the json like below.

{
  "ARN": "arn:aws:secretsmanager:yourregion:accountnumber:secret:signed-cookie-ascii",
  "Name": "signed-cookie",
  "VersionId": "XXXX"
}

Note ARN.

2. Edit ./cdk.json

  "config": {
    "privateKeySecretCompleteArn": "Replace with ARN in the above json"
    //
  }

1. Open CloudFront
2. Go to Key Management > Public Keys
3. Click Create public key
4. Paste ${KEYPAIR_NAME}_pub.pem created the previouss step. Name has no effect to this deployment. And hit Create public key.
5. Got to Key Management > Key groups
6. Click Create key group
7. Input your favorite Name and select the public key you created before in Public keys field. And hit Create key group.
8. Move to the detail page of the key group.
9. Edit ./cdk.json

  "config": {
    "keypairId": "ID on Public keys panel",
    "publicKeyId": "ID on Details panel",
    //
  }

npm ci
npm run cdk bootstrap
npm run cdk bootstrap -- --region=us-east-1
npm run cdk deploy -- --all

certificate-stack is only deployable in us-east-1.

1. Open the url https://app.{your domain}. eg. https://app.example.com if your domain is example.com
2. Image is not visible.
3. Click Get Signed Cookie button.
4. You see my pretty dog and cookie in dev tool.

npx cdk destroy --force --all

See CONTRIBUTING for more information.

This library is licensed under the MIT-0 License. See the LICENSE file.