Connecting a SSL cert to a CloudFront CDN in CloudFormation

问题

So far I have this to create the resources.

"staticFileBucketPolicy": {
  "Type": "AWS::S3::BucketPolicy",
  "DependsOn": "staticFileBucket",
  "Properties": {
    "Bucket": { "Ref": "staticFileBucket" },
    "PolicyDocument": {
      "Version": "2012-10-17",
      "Statement": [{
        "Sid": "AddPerm",
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": { "Fn::Join" : ["", ["arn:aws:s3:::", { "Ref" : "staticFileBucket" } , "/*" ]]}
      }]
    }
  }
},

"certificate": {
  "Type": "AWS::CertificateManager::Certificate",
  "Properties": {
    "DomainName": { "Ref": "Domain" },
    "SubjectAlternativeNames": [
      { "Fn::Join": ["", [ "*.", { "Ref": "Domain" } ]] }
    ],
    "DomainValidationOptions" : [{
      "DomainName": { "Ref": "Domain" },
      "ValidationDomain" : { "Ref": "Domain" }
    }],
    "Tags": [{
      "Key": "CloudFormationStack",
      "Value": { "Ref": "AWS::StackName" }
    }]
  }
},

"staticCDN": {
  "Type": "AWS::CloudFront::Distribution",
  "DependsOn": "staticFileBucket",
  "Properties": {
    "DistributionConfig": {
      "Comment": "CDN for Sagely static files.",
      "Enabled": true,
      "DefaultRootObject": "index.html",
      "DefaultCacheBehavior": {
        "AllowedMethods": [ "HEAD", "GET", "OPTIONS" ],
        "TargetOriginId": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" } ]] },
        "ForwardedValues": {
          "QueryString": false,
          "Headers": [ "Access-Control-Request-Headers", "Access-Control-Request-Method", "Origin" ]
        },
        "ViewerProtocolPolicy": "redirect-to-https"
      },
      "Origins": [{
        "DomainName": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" }, ".s3.amazonaws.com" ]] },
        "Id": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" } ]] },
        "S3OriginConfig": { }
      }]
    }
  }
},

The CDN works through my custom domain. But how to I connect the SSL certificate to the CDN?

回答1:

You want to have a ViewerCertificate property on your DistributionConfig. It should be something like:

  "ViewerCertificate": {
    "AcmCertificateArn": { "Ref": "certificate" },
    "SslSupportMethod": "sni-only"
  }

Based on your code, probably want to update your staticCDN to something like:

"staticCDN": {
  "Type": "AWS::CloudFront::Distribution",
  "DependsOn": "staticFileBucket",
  "Properties": {
    "DistributionConfig": {
      "Comment": "CDN for Sagely static files.",
      "Enabled": true,
      "DefaultRootObject": "index.html",
      "DefaultCacheBehavior": {
        "AllowedMethods": [ "HEAD", "GET", "OPTIONS" ],
        "TargetOriginId": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" } ]] },
        "ForwardedValues": {
          "QueryString": false,
          "Headers": [ "Access-Control-Request-Headers", "Access-Control-Request-Method", "Origin" ]
        },
        "ViewerProtocolPolicy": "redirect-to-https"
      },
      "Origins": [{
        "DomainName": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" }, ".s3.amazonaws.com" ]] },
        "Id": { "Fn::Join": ["", [ { "Ref": "SubDomain" }, "-static.", { "Ref": "Domain" } ]] },
        "S3OriginConfig": { }
      }],
      "ViewerCertificate": {
        "AcmCertificateArn": { "Ref": "certificate" },
        "SslSupportMethod": "sni-only"
      }
    }
  }
},

回答2:

You are missing the ViewerCertificate property.

This should be a Ref to the certificate, since ref returns the ARN of the certificate.

来源：https://stackoverflow.com/questions/46479369/connecting-a-ssl-cert-to-a-cloudfront-cdn-in-cloudformation