Create a gist now

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Basic HTTP Authentication for CloudFront with Lambda@Edge
'use strict';
exports.handler = (event, context, callback) => {
// Get request and request headers
const request = event.Records[0].cf.request;
const headers = request.headers;
// Configure authentication
const authUser = 'user';
const authPass = 'pass';
// Construct the Basic Auth string
const authString = 'Basic ' + new Buffer(authUser + ':' + authPass).toString('base64');
// Require Basic authentication
if (typeof headers.authorization == 'undefined' || headers.authorization[0].value != authString) {
const body = 'Unauthorized';
const response = {
status: '401',
statusDescription: 'Unauthorized',
body: body,
headers: {
'www-authenticate': [{key: 'WWW-Authenticate', value:'Basic'}]
},
};
callback(null, response);
}
// Continue request processing if authentication passed
callback(null, request);
};
@lmakarov

This comment has been minimized.

Show comment
Hide comment
Owner

lmakarov commented Aug 30, 2017

See my article on Medium for details.

@homaily

This comment has been minimized.

Show comment
Hide comment
@homaily

homaily Jan 16, 2018

Thanks Leonid for sharing this.

Lines 8 to 13 if moved before the function (before line 2) it will be parsed just once and cached in memory for next executions.

homaily commented Jan 16, 2018

Thanks Leonid for sharing this.

Lines 8 to 13 if moved before the function (before line 2) it will be parsed just once and cached in memory for next executions.

@vssystemluba

This comment has been minimized.

Show comment
Hide comment
@vssystemluba

vssystemluba Mar 27, 2018

This should be in the official AWS docs. Extremely useful; thanks for sharing!

This should be in the official AWS docs. Extremely useful; thanks for sharing!

@pmcdowell-okta

This comment has been minimized.

Show comment
Hide comment
@pmcdowell-okta

pmcdowell-okta Apr 12, 2018

Agreed ! There is little documentation on Lambda Edge. Thank you for sharing the code

Agreed ! There is little documentation on Lambda Edge. Thank you for sharing the code

@trinath-k

This comment has been minimized.

Show comment
Hide comment
@trinath-k

trinath-k Apr 12, 2018

Imakarov did you finish full doc on how to setup this? I am having hard time implementing this getting errors when assigning role to lambda. Which role should i use and which policies i have to add that role?

Imakarov did you finish full doc on how to setup this? I am having hard time implementing this getting errors when assigning role to lambda. Which role should i use and which policies i have to add that role?

@pmcdowell-okta

This comment has been minimized.

Show comment
Hide comment
@pmcdowell-okta

pmcdowell-okta Apr 13, 2018

@trinath-k

I had the same problem. Your Lambda has to be in N. Virginia (althought that might have changed).

Find the role you assigned to the Lambda Function, and edit the policy "Trust Relationship" to something like this:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "edgelambda.amazonaws.com", "lambda.amazonaws.com" ] }, "Action": "sts:AssumeRole" } ] }

This worked for me. AWS Documentation does not explain that very well.

Good Luck !

pmcdowell-okta commented Apr 13, 2018

@trinath-k

I had the same problem. Your Lambda has to be in N. Virginia (althought that might have changed).

Find the role you assigned to the Lambda Function, and edit the policy "Trust Relationship" to something like this:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "edgelambda.amazonaws.com", "lambda.amazonaws.com" ] }, "Action": "sts:AssumeRole" } ] }

This worked for me. AWS Documentation does not explain that very well.

Good Luck !

@trinath-k

This comment has been minimized.

Show comment
Hide comment
@trinath-k

trinath-k Apr 13, 2018

Hi, I have configured everything. But i still can't access file in my s3 bucket. I am trying to access a file in this s3 bucket. it's only listing the object. I wanted it be able to download or read.

This XML file does not appear to have any style information associated with it. The document tree is shown below.

inventory-endpoints


1000
false

inventory-endpoints-04.06.2018.yaml
2018-04-13T20:40:38.000Z
"b18f7a425f4be500caf2fc7f3107e77c"
10308
STANDARD

trinath-k commented Apr 13, 2018

Hi, I have configured everything. But i still can't access file in my s3 bucket. I am trying to access a file in this s3 bucket. it's only listing the object. I wanted it be able to download or read.

This XML file does not appear to have any style information associated with it. The document tree is shown below.

inventory-endpoints


1000
false

inventory-endpoints-04.06.2018.yaml
2018-04-13T20:40:38.000Z
"b18f7a425f4be500caf2fc7f3107e77c"
10308
STANDARD

@iamwalker

This comment has been minimized.

Show comment
Hide comment
@iamwalker

iamwalker Apr 24, 2018

Is there a way to set this up on specific directories in the s3 bucket? i.e. domain.com allowed, domain.com/dir triggers auth

Is there a way to set this up on specific directories in the s3 bucket? i.e. domain.com allowed, domain.com/dir triggers auth

@tvalleley

This comment has been minimized.

Show comment
Hide comment
@tvalleley

tvalleley Jun 13, 2018

@iamwalker In CloudFront, under "Origin Settings", you can set the Origin Path. For example, I'm running an S3 bucket with dev, stage and prod folders. I have one CloudFront distribution for each one.

@iamwalker In CloudFront, under "Origin Settings", you can set the Origin Path. For example, I'm running an S3 bucket with dev, stage and prod folders. I have one CloudFront distribution for each one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment