AWS CloudFront Private Content for Craft CMS
Create CloudFront signed URLs on the fly to protect your assets., (*1)
Overview
This plugin utilizes the AWS Cloudfront API to generate signed URLs. For an overview on serving private content via AWS CloudFront, read the how-to guide on Amazon., (*2)
You can limit access to static assets via,, (*3)
- setting an expiration date on the URL
- locking the URL down to IP addresses of the end-user
Requirements
- PHP 5.5+
- an AWS CloudFront distribution, configured to serve private content
- CloudFront Key Pair private key file (AWS docs)
Installation
To install, follow these steps:, (*4)
1) Install with Composer (recommended), (*5)
composer require benjamin-smith/craft-awscloudfront-private-content
-OR- download & unzip the file and place the awscloudfront
directory into your craft/plugins
directory, (*6)
-OR- do a git clone https://github.com/benjamin-smith/craft-awscloudfront-private-content.git
directly into your craft/plugins
folder. You can then update it with git pull
, (*7)
2) Place your CloudFront Key Pair private key in craft/storage/awscloudfront/cloudfront.pem
., (*8)
3) Install plugin in the Craft Control Panel under Settings > Plugins, (*9)
Configuring
Create a config file in craft/config/awscloudfront.php
with the following settings:, (*10)
<?php
return [
'awsRegion' => 'us-east-1',
'hostUrl' => 'https://example-distribution.cloudfront.net',
'keyPairId' => 'xxx',
];
Then create a sample "policy" in the plugin settings menu. You can configure the expiration time and whether or not to restrict access to URLs based on IP address. You can have multiple policies, and choose which to use with each URL that is generated., (*11)
Using
This plugin creates a signed URL from a non-signed CloudFront URL. For example, if your resource is:, (*12)
https://example-distribution.cloudfront.net/path/to/file.pdf
, (*13)
Your template tag would be:, (*14)
{{ craft.awscloudfront.getPrivateUrl('path/to/file.pdf', 'yourPolicyHandle') }}
Or, you can generate a signed URL from a custom plugin:, (*15)
craft()->awsCloudfront_privateResource->getPrivateUrl('path/to/content', 'yourPolicyHandle');
Roadmap
- tighter integration with Craft Assets
- ability to configure multiple CloudFront distributions
- ability to use signed cookies to make content private