back
written on 2 January 2024
Connect Cloudflare To An AWS S3 Web Server
rcg   ·   2 January, 2024
Domain Name Prices (USD) (as of 2 Jan 2024)
Once you have created the AWS S3 web server and have a cloudflare registered custom domain name, then the next step is to connect the two together.


Replace example.com with your custom domain name.

Steps To Transfer A Custom Domain
Cloudflare Steps:
  1. on cloudflare's home page, click on the example.com site you have already created with cloudflare
  2. on the left panel, click on DNS
  3. If there are any existing records delete them
  4. click on Add record and add:
    Type: CNAME
    Name: www
    Target: www.example.com.s3-website-us-west-2.amazonaws.com
  5. note the bucket name has no https:// in the front and no "/" at the end
  6. click on Add record and add a second record for example.com (no www prefix):
    Type: CNAME
    Name: example.com
    Target: example.com.s3-website-us-west-2.amazonaws.com
  7. on the left panel select DNS > Settings and confirm the DNSSEC is on
  8. on the left panel select SSL/TLS > Overview and confirm that the mode is Flexible
  9. on the left panel select SSL/TLS > Edge Certificates and confirm that Always Use HTTPS is on

AWS Steps:
  1. on AWS S3 click on your www.example.com S3 bucket
  2. under the Permissions tab click on Block public access Edit button
  3. uncheck everything, then check the first two:
  4. Block public access to buckets and objects granted through new access control lists (ACLs)
  5. Block public access to buckets and objects granted through any access control lists (ACLs)
  6. click Save changes
  7. still under the Permissions tab, click on Bucket Policy Edit button
  8. replace the JSON so we only use the current cloudflare servers. (this example is as of 7 Dec 2023)
  9. replace the highlighted text with your custom url and a "/*" at the end 

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudFlareReadGetObject",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:getObject",
      "Resource": "arn:aws:s3:::www.example.com/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "2400:cb00::/32",
            "2405:8100::/32",
            "2405:b500::/32",
            "2606:4700::/32",
            "2803:f800::/32",
            "2a06:98c0::/29",
            "2c0f:f248::/32",
            "103.21.244.0/22",
            "103.22.200.0/22",
            "103.31.4.0/22",
            "104.16.0.0/13",
            "104.24.0.0/14",
            "108.162.192.0/18",
            "131.0.72.0/22",
            "141.101.64.0/18",
            "162.158.0.0/15",
            "172.64.0.0/13",
            "173.245.48.0/20",
            "188.114.96.0/20",
            "190.93.240.0/20",
            "197.234.240.0/22",
            "198.41.128.0/17"
          ]
        }
      }
    }
  ]
}

  10. click Save changes

You can no longer access the site through http://www.example.com.s3-website-us-west-2.amazonaws.com/ but now can access it through www.example.com (since cloudflare has access to this S3 bucket).