aws-amplify / aws-amplify/amplify-cli
Leftovers after disabling hosting to DEV (S3 only with HTTP) in v11.1.1
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 825
- Avg merge
- 11d 23h
- Merged PRs (30d)
- 2
Description
### How did you install the Amplify CLI?
yarn
### If applicable, what version of Node.js are you using?
18.17.0
### Amplify CLI Version
12.2.3
### What operating system are you using?
Mac
### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
No
### Describe the bug
Until version 11.1.0 we had two options for deployment to S3:
- DEV (S3 only with HTTP)
- PROD (S3 with CloudFront using HTTPS)
As far as I understand the option to deploy to S3 only was removed in v11.1.1 via this PR https://github.com/aws-amplify/amplify-cli/pull/12530 because of changes in S3 bucket handling ACLs. However, this work has still some unresolved consequences and could result in further improvements - see below
### Expected behavior
1. Currently when you deploy to CloudFront and S3 and later execute `amplify configure hosting` and choose Website you get
Looks like the option to configure Website and this error handling are no longer necessary.
https://github.com/aws-amplify/amplify-cli/blob/dev/packages/amplify-category-hosting/lib/S3AndCloudFront/helpers/configure-Website.js
2. S3 static website generated by CloudFormation is no longer necessary. I imagine it could be useful before v11.1.1 where you could setup either a publicly available S3 static website or a private S3 static website with Cloudfront and handle this with one CFN template. But now it is not needed - typically for production grade deployments it is just enough to create a regular S3 bucket with Cloudfront.
3. By the way, I noticed that Cloudfront console gives some misleading recommendation to use S3 website endpoint where in their docs they say it should not be used with OAC/OAI
4. Origin Access Identity is legacy and Origin Access Control is now recommended so this issue is still valid https://github.com/aws-amplify/amplify-cli/issues/12059
For differences please check:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
6. Also CloudFront have some predefined policy settings that are recommended and could be used here
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html
7. I understand that all of the above might require some regression/migration testing as most customers have these resources created with the current CloudFormation template.
https://github.com/aws-amplify/amplify-cli/blob/dev/packages/amplify-category-hosting/lib/S3AndCloudFront/template.json
If anything is unclear please do not hesitate to ask me.
Also please let me know if you would like me to take care the above changes (if you consider to implement any) or is there a codeowner who would rather handle these ?
### Reproduction steps
1. `amplify add hosting` with Amazon CloudFront and S3
2. `amplify configure hosting` for Website
### Project Identifier
_No response_
### Log output
```
# Put your logs below this line
```
### Additional information
_No response_
### Before submitting, please confirm:
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.
Contributor guide
Assessment
This issue has not been assessed yet.