How to Use AWS ALB to Securely Access S3 Get with Authentication

Select Language:

If you’re using an Application Load Balancer (ALB) and want to direct traffic to different Amazon S3 buckets based on the hostname, there’s good news. The ALB now allows you to change the Host header to any value you choose. This means you can set the Host header to match the virtual-hosted DNS name of the S3 bucket, such as “BUCKETNAME.s3.REGIONCODE.amazonaws.com.” When you do this, your Virtual Private Cloud (VPC) interface endpoint will accept the new Host header and forward it to S3, helping S3 identify which bucket to serve the request.

Here’s how you can set it up to serve multiple buckets using a single ALB. Let’s say your domain is “example.com.” You should start by creating a wildcard TLS certificate for “*.example.com” through AWS Certificate Manager (ACM). Attach this certificate to your ALB’s HTTPS listener to enable secure connections.

Next, you’ll need to configure your listener rules. Set the rules to only accept requests where the Host header matches the pattern “^[^.]+\.example\.com$.” These are requests where the subdomain part before “.example.com” can be anything. After verifying this, set up a transformation rule that captures the subdomain and rewrites it to the corresponding S3 bucket name.

Specifically, use a pattern like “^([^.]+)\.example\.com$” and replace it with “$1.s3.REGIONCODE.amazonaws.com,” making sure to substitute “REGIONCODE” with the region your ALB and buckets are located in. For instance, if the request is for “mybucket1.example.com,” it will be rewritten to “mybucket1.s3.REGIONCODE.amazonaws.com.” Then, the request will be directed to the correct S3 bucket.

This approach allows the ALB to serve multiple S3 buckets seamlessly. Each hostname can point to a different bucket, and the traffic is routed correctly based on the subdomain part of the hostname. It’s a simple way to manage multiple buckets behind a single load balancer while maintaining a clean and scalable DNS setup.