Using AWS CloudFront Path-Based behaviour for uploading to multiple S3 Buckets with CF and S3 resigned URLs
TLDR In a nutshell, this allows you to: Replace multiple S3 endpoint with a single custom CloudFront domain (e.g., for branding reasons) Use Path-Based behaviour in CloudFront to handle destination bucket (e.g., for app compatibility reasons) Combine the following: CloudFront Presigned URL - an "outer auth" for the request to be let in S3 Presigned Post - an "inner auth" against S3 for to POST request to be processed Design Diagram Points to note: S3 Presigned Post URL The S3 endpoint generated is discarded The POST field containing signature (S3 Auth), policy, bucket name and key related to the upload is retained CloudFront Signed URL The URL is made up of CloudFront custom domain + Path of each bucket's associated CloudFront behaviour CloudFront signer adds query string to the URI with signatures, expirations, etc The Signed URL forms the outer credentials (CloudFront auth) to access the CloudFront behaviour These two are then combined and sent to the client...