Amplify-cli: Amplify Publish - CloudFront 307 redirection and Access Denied after deployment in non-US region

[awsed]

Describe the bug

After amplify add hosting and amplify publish deployment where resources are created in a non-US region, CloudFront redirects (307) to S3 which returns AccessDenied. This is most likely because CloudFront is configured with Origin Access Identity so the S3 bucket cannot be accessed directly. I suspect it might be related to: https://aws.amazon.com/premiumsupport/knowledge-center/s3-http-307-response/ and the bucket on CloudFront doesn't have the region in the URL.

> amplify version
0.2.1-multienv.4

[UnleashedMind]

Thanks @awsed , we are investigating this issue.

[kaustavghosh06]

@awsed Cloudfront takes around 20-30 minutes sometimes to deploy and have the site up and running the first time. Were you able to access the site eventually?

[awsed]

It does work eventually but it does take more than minutes, more like hours or up to a whole day (as you can see in the support link it can take up to 24h). And if you try to access before that, CloudFront will cache the error and it'll make it worst. If you're not familiar with CloudFront and AWS it'll provide a bad user experience.

An easy fix would be to add the region to the S3 URL/FQDN as per the support link.

[kaustavghosh06]

@UnleashedMind Could you look into this and make the change? Thanks!

[UnleashedMind]

@awsed
I did a bit of investigation on this, what you have guessed is correct.
But the fixed described in the link (see the pasted section below), does not work.

...if the bucket is in us-west-2, you can change the Origin Domain Name from bucketname.s3.amazonaws.com to bucketname.s3-us-west-2.amazonaws.com.

If we change the CloudFormation template, and set the CloudFrontDistribution's property DistributionConfig/Origins/DomainName to a format like that, the CloudFormation will report an error like this:
The parameter Origin DomainName does not refer to a valid S3 bucket. (Service: AmazonCloudFront; Status Code: 400; Error Code: InvalidArgument; Request ID: xxxx

There was a post on this in the aws forum many years ago, but curiously it does not seem to have been completely resolved.
https://forums.aws.amazon.com/thread.jspa?messageID=495923

IMHO, we will have to live with this behavior before they provide a fix. Please let us know if you have other suggestions.

[UnleashedMind]

We've updated our doc on this.
Closing this issue.
feel free to re-open if needed.

[onhate]

For anyone facing similar issues deploying to us-west-2, you should modify the S3AndCloudFront/template.json section that specifies the origin bucket for CloudFront from

"DomainName": {
  "Fn::GetAtt": [
    "S3Bucket",
    "DomainName"
  ]
}

"DomainName": {
  "Fn::GetAtt": [
    "S3Bucket",
    "RegionalDomainName"
  ]
}

[bearsworth]

For anyone facing similar issues deploying to us-west-2, you should modify the S3AndCloudFront/template.json section that specifies the origin bucket for CloudFront from

"DomainName": {
  "Fn::GetAtt": [
    "S3Bucket",
    "DomainName"
  ]
}

"DomainName": {
  "Fn::GetAtt": [
    "S3Bucket",
    "RegionalDomainName"
  ]
}

You totally saved me. I had an AccessDeny error and this caused it.

[realityfilter]

This error breaks all amplify projects with hosting in all regions except us-west-2. Could this ticket be reopened, please. This error is not easy to debug and this ticket saved me a lot more investigation time. Thank!

Using amplify version 4.20.0

[LosD]

@sirhc9 In that link they're still using DomainName instead of RegionalDomainName? Or do you mean some other fix?

[sirhc9]

@sirhc9 In that link they're still using DomainName instead of RegionalDomainName? Or do you mean some other fix?

Thanks LosD, my mistake, misread the template in master. I've edited my previous comment to correct