{"id":1942,"date":"2016-08-17T08:41:45","date_gmt":"2016-08-17T08:41:45","guid":{"rendered":"https:\/\/www.botreetechnologies.com\/blog\/?p=1942"},"modified":"2023-02-16T16:02:14","modified_gmt":"2023-02-16T10:32:14","slug":"ruby-on-rails-discovering-amazon-cloudfront","status":"publish","type":"post","link":"https:\/\/www.botreetechnologies.com\/blog\/ruby-on-rails-discovering-amazon-cloudfront\/","title":{"rendered":"Ruby on Rails\u200a-\u200aDiscovering Amazon CloudFront"},"content":{"rendered":"\n

Whenever we come across implementing file uploading functionality in Rails, we either use the CarrierWave<\/a> or the PaperClip<\/a> gem. Fog<\/a> is the choice for Amazon S3. This setup works fairly well, easy to setup and runs successfully on production in a day.<\/p>\n\n\n\n

Background<\/h2>\n\n\n\n

For security reasons, Amazon S3 configuration for CarrierWave has a configuration option ‘fog_authenticated_url_expiration<\/i>‘ which defines the seconds to live for the URL, when used with ‘fog_public = true<\/i>‘. This enables CarrierWave to generate a signed URL which can be accessed for the defined seconds only, after which the S3 document URL expires. This is provided for security reasons. When we want to upload private data on the S3 cloud buckets, such an arrangement keeps the data secure from guest users.<\/p>\n\n\n\n

\n

What happens when the URL expires?<\/p>\n<\/blockquote>\n\n\n\n

In real time, when user has opened up a page which has private S3 download URLs and stayed inactive for sometime, the link timeout will expire it. Now, when user clicks on the link, it tries to open the document but S3 would throw ‘AccessDenied<\/i>‘ error and show an error page with an XML content.<\/p>\n\n\n\n

<Error>\n  <Code>AccessDenied<\/Code>\n  <Message>Request has expired<\/Message>\n  <X-Amz-Expires>300<\/X-Amz-Expires>\n  <Expires>2016-08-05T13:05:37Z<\/Expires>\n  <ServerTime>2016-08-17T14:01:50Z<\/ServerTime>\n  <RequestId>5e674uth3q4<\/RequestId>\n  <HostId>\n    XERYHFXDZHBDFHt7e45ysetrzhdfy\n  <\/HostId>\n<\/Error><\/pre>\n\n\n\n
This appears annoying and the user experience deteriorates. To handle such a case gracefully, one of the following needs to be done.<\/p>\n\n\n\n
    \n
  1. Make the download URLs public – This is not feasible most of the times.<\/li>\n\n\n\n
  2. Increase the time to expire, which just decreases the probability of this error, but does not really fix it, its just a work around.<\/li>\n\n\n\n
  3. Implement a page instead of this XML response. – Bang!<\/b><\/li>\n<\/ol>\n\n\n\n
    Solution<\/h3>\n\n\n\n
    For point 3 defined above, Amazon has another service called CloudFront<\/b>which allows us to define custom error page and rules to redirect to it on specific HTTP errors. But as usual, Amazon has “amazing<\/i>” documentation to for help!<\/p>\n\n\n\n
    Never-mind, There are some really nice articles which explain the whole process of configuring CloudFront<\/a>.<\/p>\n\n\n\n
    \n
    Custom Error Pages and Responses for Amazon CloudFront | AWS Blog<\/b>
    You can create a separate custom error response for each of the ten HTTP status codes listed in the menu. The Response…<\/i> aws.amazon.com<\/a><\/p>\n<\/blockquote>\n\n\n\n
    \n
    But, What next?<\/p>\n<\/blockquote>\n\n\n\n
    Configuring CloudFront<\/a> just does not plug it with the S3 configuration for CarrierWave. First thing is, CloudFront<\/a> has created a CDN URL for us, but to use that URL, we need to replace the domain name in S3 URL.<\/p>\n\n\n\n
    So, “https:\/\/s3.amazonaws.com\/exampleBucket\/26b8dbda-32a8-4e54-99d8.txt?X-Amz-Date=20160805T130037Z&X-Amz-Expires=300…<\/i>” should be changed as “https:\/\/my-new-id.cloudfront.net\/exampleBucket\/26b8dbda-32a8-4e54-99d8.txt?X-Amz-Date=20160805T130037Z&X-Amz-Expires=300…<\/i>“.<\/p>\n\n\n\n
    This URL would be accessible, and to change it at where its generated we have to use the following property in ‘carrier_wave.rb’ initializer.<\/p>\n\n\n\n
    config.asset_host = \"https:\/\/my-new-id.cloudfront.net\"<\/pre>\n\n\n\n
    But this does not work with ‘config.fog_public = true<\/i>‘ option, and we don’t want to make it public! Its a bottleneck!<\/p>\n\n\n\n
    \n
    How to generate CloudFront signed URL with CarrierWave?<\/p>\n<\/blockquote>\n\n\n\n
    cloudfront-signer<\/a> gem to the rescue! Yes, there is another gem which provides the interface to create signed URL (similar to S3 URLs) with CarrierWave. We need to follow the steps below.<\/p>\n\n\n\n