Skip to main content
Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console. Open IP Lab Portal

​
Overview

​
Lab details

  1. Welcome to this comprehensive lab that will guide you through the process of creating an Amazon CloudFront distribution, which will allow you to distribute a publicly accessible image file from an Amazon S3 bucket.
  2. This tutorial will explain how to utilize custom error pages and geo-restriction. It will guide you through the process of configuring these features.
  3. Duration: 1 hour 30 minutes
  4. AWS Region: US East (N. Virginia) us-east-1

​
Introduction

​
What is CloudFront?

  • Amazon CloudFront is a content delivery network (CDN) offered by AWS.
  • CDN provides a globally-distributed network of proxy servers which cache content , i.e., web videos or other bulky media, more locally to consumers, thus improving access speed for downloading the content.
  • CloudFront service works on a pay-as-you-go basis.
  • CloudFront works with origin servers like S3, EC2 where the content is stored and is pushed out to multiple CloudFront servers as content is requested.
  • When CloudFront is enabled, the content is stored on the main S3 server.
  • Copies of this content are created on a network of servers around the world called CDN.
  • Each server within this network is called an Edge server, which will only have a copy of your content.
  • When a request is made to the content, the user is provided from the nearest edge server.
  • CloudFront has features similar to dynamic site acceleration, a method used to improve online content delivery.
  • CloudFront accelerates the delivery of dynamic content by moving it closer to the user to minimize internet hops involved in retrieving the content.
  • CloudFront’s Web distribution supports “Progressive” download i.e., data from S3 is cached and then streamed without disruptions.
  • Due to that, the user cannot move front or back in the video i.e., the video is processed bit by bit.
  • CloudFront’s Web distribution support “Streaming” allows users to directly watch without any download.
  • Due to that, the user can move front or back in the video, the latency is based on the size of the file and the customer’s Internet bandwidth.
  • This service is beneficial for those developing a website that distributes a lot of content and needs to scale-up.
  • It helps reduce costs and improve the performance of a website by providing high data transfer speeds and low latency.

​
Architecture diagram

​
Task details

  1. Sign in to AWS Management Console
  2. Create an S3 Bucket
  3. Upload a file to the S3 bucket.
  4. Create Custom Error pages.
  5. Make the objects public.
  6. Create a new Amazon CloudFront distribution.
  7. Accessing images through Cloudfront.
  8. Configuring custom Error Page
  9. Restricting the Geographic Distribution of your content.
  10. Validation of the lab.

​
Launching the lab environment

  1. To launch the lab environment, Click on the Launch lab button.
  2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
  3. Once the Lab is started, you will be provided with IAM user name, Password, Access Key, and Secret Access Key.
You can only start one lab at any given time

​
Lab guide

​
Lab steps

​
Task 1: Sign in to AWS Management Console

  1. Click on the Open console button, and you will get redirected to AWS Console in a new browser tab.
  2. On the AWS sign-in page,
    • Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
    • Now copy your User Name and Password in the Lab Console to the IAM Username and Password in AWS Console and click on the Sign in button.
  3. Once Signed In to the AWS Management Console, Make the default AWS Region as US East (N. Virginia) us-east-1.

​
Task 2: Create S3 Bucket

In this task, we are going to create a new S3 bucket in the US East (N. Virginia) region with a unique name enabling ACLs, and allowing public access.
  1. Make sure you are in the US East (N. Virginia) us-east-1 Region.
  2. Navigate to the Services menu at the top. Click on S3 in the Storage section.
  3. In the S3 dashboard, click on the Create bucket and fill in the bucket details.
    • Bucket name: Enter whizlabs1234567
      • Note: S3 Bucket names are globally unique, choose a name that is available.
    • Object Ownership: Select ACLs enabled option and choose Object writer as Object owner
    • Scroll down to Block Public Access settings for this bucket and Uncheck the Block all Public Access and acknowledge the change.
  • No need to change anything further, just click on the Create bucket button.

​
Task 3: Upload a file to an S3 bucket

  1. Click on the bucket name you just created and you can see that there are no objects created in the bucket.
  2. You can upload any image from your local machine or you can download the test image from Download me
  3. To upload a file to our S3 bucket,
    • Click on the Upload button.
    • Click on Add files.
    • Browse for image we provided and select it. {NOTE : use the same image provided to ignore the validation failure}
    • Click on the Upload button.
    • You can watch the progress of the upload from within the transfer panel at the bottom of the screen.
    • Once your file has been uploaded, click on Close and you can see an object in the bucket.

​
Task 4: Creating Custom Error Pages

In this task, we will learn how to create customized error pages for CloudFront. These pages will be displayed in the event that an origin returns an HTTP 4xx or 5xx error. To do this, we must ensure that the error pages are stored in a location that CloudFront can access. In this case, we will use the same S3 bucket that we created previously.
  1. To set up a custom error page, access the S3 bucket by clicking on it.
  2. Click on Create Folder button to create a folder.
  3. Enter the folder name as CustomErrors. For Server-side encryption Select Specify an encryption key keep rest things as default.
  4. Click on the Create folder button.
  5. Click on the new CustomErrors folder.
  6. We will create an error.html file:
    • Create an error.html file in your local system using Notepad.
    • This custom HTML page will be used for showing errors in CloudFront.
    • Sample error.html content:
  7. Use the Upload button to upload the error.html file in the folder.
  8. We will create a block.html file:
    • Create a block.html file in your local using Notepad.
    • This custom HTML page will be used for showing geo-restrictions of your content in CloudFront.
    • Sample block.html content:
  9. Use the Upload button to upload the block.html file in the folder.

​
Task 5: Making the objects public

  1. Navigate back to the bucket and click on the image name. You can see the image details like Owner, size, link, etc.
  2. Copy the Object URL and paste it into a new tab.
  3. Example: https://whizlabs1234567.s3.amazonaws.com/whizlabs\_logo\_58\_32.png
    • You will see the AccessDenied message, meaning the object is not publicly accessible.whizlabs_logo_58_32.png
  4. Go back to the Bucket and click the Permissions tab.
  5. Scroll down to the Bucket Policy and click on Edit button.
  1. Copy and paste the below policy and save the policy.
  • Note: Change the name of the bucket ARN with your bucket ARN in both the Resource option in the code.
{ “Version”: “2012-10-17”, “Statement”: [ { “Effect”: “Allow”, “Action”: [“s3:ListBucket”], “Principal”: {“AWS”: ”*”}, “Resource”: “<YOUR_BUCKET_ARN>” }, { “Effect”: “Allow”, “Action”: [“s3:GetObject”, “s3:PutObject”], “Principal”: {“AWS”: ”*”}, “Resource”: “<YOUR_BUCKET_ARN>/*” } ] }
  1. Open the Image Object URL again or refresh the one already open.
  2. If you can see your uploaded image in the browser, it means your image is publicly accessible. If not, check your bucket policy again.

​
Task 6: Creating a CloudFront Distribution

  1. Navigate to CloudFront by clicking on the Services menu at the top, then click on CloudFront in the Network and Content Delivery section.
  2. Click on Create a CloudFront distribution button.
  1. Choose a plan: Scroll down and select Pay as you go plan and click Next.
  1. Distribution name: Enter the distribution name of your choice. Keep rest as default and click on Next.
  2. Now Configure distribution as follows: Specify Origin: Select Amazon S3 as Origin type, then click on Browse S3 and select the bucket you have created. Leave everything as default and click Next.
  1. In Enable security, choose Do not enable security protections under Web Application Firewall(WAF) and click Next.
  1. In Review and Create, leave everything as default and click on the Create distribution button.
  2. You can see that the CloudFront distribution is enabled successfully. Note: This process will take around 5-10 minutes.
  3. The domain name that Amazon CloudFront assigns to your distribution appears in the list of distributions.

​
Task 7: Accessing Image through CloudFront

Amazon CloudFront is now pointed to Amazon S3 bucket origin and you know that the domain name is associated with the distribution. You can create a link to the image in the Amazon S3 bucket with that domain name.
  1. For testing your distribution, copy your domain name and append your image name after the domain name.
  2. Open the CloudFront URL in a new tab. You can see your uploaded image.
  3. You can see how much faster the CloudFront URL image loads as compared to the S3 URL. When end users request an object using a CloudFront domain name, they are automatically routed to the nearest edge location for high-performance delivery of your content.

​
Task 8 : Configuring Custom Error Page

  1. Navigate back to CloudFront Dashboard and select the distribution created.
  2. Select the Error pages tab.
    • Click on the Create custom error response button.
    • Now we need to set up our custom error page:
      • HTTP Error Code: Select 404: Not Found
      • Error Caching Minimum TTL: Enter 10
      • Customize Error Response: Select Yes
      • Response Page Path: Enter /CustomErrors/error.html
      • HTTP Response Code: Select 404: Not Found
      • Click on Create custom error response button.
  3. Navigate back to Distributions and wait for your distribution to complete state to change Deploy.
    • Note: This process will take around 5-10 minutes.
    • Once the state has changed to Deploy, you can verify the deployment by checking the Last modified column, it should display the most recent timestamp, indicating the distribution has been updated. After this, proceed to test the error page.
    • For testing your distribution, copy your domain name and append the name of an image that does not exist in your S3 bucket
    • Open the CloudFront URL in a new tab.
  4. If you can see your HTML error page in the browser, it means you successfully set up your custom error page.

​
Task 9 : Restricting the Geographic Distribution of Your Content

If you need to prevent users in selected countries from accessing your content, you can specify either a whitelist (countries where they can access your content) or a blacklist (countries where they cannot) by using restrictions.
  1. On the distribution settings page, select Security tab and expand CloudFront geographic restrictions click on Edit link near Countries.
    • Restriction Type: Select Block list
    • Select the country where you are currently and click on it to check this option.
    • Click on Save changes button.
  2. Go to the distribution list and wait for your distribution to complete the state changed to deployed.
    • Once the state has been changed to deployed, we will test the restriction through CloudFront in the browser.
    • You can see the following error message:
      • 403: Error The Amazon CloudFront distribution is configured to block access from your country.
  3. Let us configure a custom error page:
  • Navigate back to CloudFront Dashboard and select the distribution you have created.
  • On the settings page, select Error pages tab.
  • Click on the Create custom error response button.
  • On the settings page, select Error pages tab
  • Now we need to set up our custom error page:
    • Http Error Code: Select 403: Forbidden
    • Error Caching Minimum TTL: Enter 10
    • Customize Error Response: Select Yes
    • Response Page Path: Enter /CustomErrors/block.html
    • HTTP Response Code: Select 403: Forbidden
    • Click on Create custom error response button.
  1. Navigate back to Distributions and wait for your distribution to complete state to change Deploy.
  2. Note: This process will take around 5-10 minutes.
  3. Once the state has been changed to Deploy, we will test the restriction through CloudFront in the browser.
  4. If you see the error, this means you successfully configured a custom error page and restricted image access from your country.
Do you know?Amazon CloudFront allows you to use custom SSL/TLS certificates, including certificates issued by third-party certificate authorities (CAs), to secure your content delivery. However, what makes this even more interesting is that CloudFront also provides an integrated solution called AWS Certificate Manager (ACM) to simplify the process of managing SSL/TLS certificates.

​
Task 10: Validation Test

  1. Once the lab steps are completed, please click on the Check my work button on the left side panel.
  2. This will validate the resources in the AWS account and displays whether you have completed this lab successfully or not.
  3. Sample output :

​
Completion and conclusion

  1. You have successfully created an Amazon CloudFront distribution and published an image through CloudFront.
  2. You learned how to configure Custom Error Pages for CloudFront Distribution.
  3. You learned how to configure restrictions based on Geo-location.
  4. You have successfully validated the lab.

​
End lab

  1. Sign out of AWS Account.
  2. You have successfully completed the lab.
  3. Once you have completed the steps, click on End lab in the IP Lab Portal and wait till the process gets completed.

​
What gets checked

When you press Check my work, the platform verifies each of these:
  • Create Public AWS S3 Bucket — Check whether a Public S3 Bucket created or not
  • check s3 object — Check whether an object is uploaded to the S3 bucket.
  • Create CloudFront Distribution — Check whether a CloudFront Distribution is created and status as Deployed or not.
  • Invoke CloudFront Distribution Domain — Check whether the CloudFront Distribution domain is accessible from the internet or not.
  • Create CloudFront Custom Error Page — Check whether a Custom Error page is created with the path error.html in the CloudFront Distribution or not.