CloudFront backed by S3 uses intermediate HTTP redirects even from HTTPS

Question

I have an AWS S3 bucket set up as a web site. It is using Route 53 for DNS and using AWS Certificate Manager for SSL certificates. The public site is a CloudFront distribution of the S3 website bucket using HTTPS. The distribution is set up to redirect HTTP to HTTPS. This entire AWS configuration is set up programmatically using the AWS Java SDK v2 (although this is not relevant to the issue, as I can verify all this manually via the AWS web console).

I have tried two types of redirects from foo.html to bar.html, both successful:

• Redirect using routing rules with <ReplaceKeyWith>bar.html</ReplaceKeyWith>, making sure to add a <HostName> (see more discussion on another Stack Overflow question).
• Redirect using redirect S3 objects, with the redirect location set to /bar.html (because object redirects apparently require absolute paths).

Everything works fine except for one oddity: regardless of which redirect approach I use, when I redirect from foo.html to bar.html, even starting at an HTTPS URL, CloudFront will initially return an insecure HTTP-based indirect URL, which then redirects to the HTTPS URL, like this:

1. https://example.com/foo.html redirects to
2. http://example.com/bar.html redirects to
3. https://example.com/bar.html

This occurs for both routing-rule redirects and S3 object redirects. I tested this using the network developer tools in both Chrome and Firefox on Windows 10.

Why is CloudFront providing the intermediate HTTP redirect? As my initial URL is using HTTPS, why doesn't it directly redirect to the HTTPS form?

Answer 1

Why is CloudFront providing the intermediate HTTP redirect?

No, it is the S3 handles the redirect, not CloudFront.

As my initial URL is using HTTPS, why doesn't it directly redirect to the HTTPS form?

In both of the redirection methods you tried, you can set the protocol to https, which will make your website redirect to an https URL directly.

For example, I have tested that the following routing rule will work as expected.

<RoutingRules>
  <RoutingRule>
    <Redirect>
      <HostName>www.example.com</HostName>
      <Protocol>https</Protocol>
      <ReplaceKeyWith>abc</ReplaceKeyWith>
    </Redirect>
  </RoutingRule>
</RoutingRules>

The routing rule above generates the following 301 response header:

Location: https://www.example.com/abc

If you are using an object to do the redirection, you can add the prefix https to the value field corresponding to the Website-Redirect-Location key.