Refused to connect 'https://s3.console.aws.amazon.com/' in a frame because AWS is 'X-Frame-Options' to 'deny'

Question

I currently just use an AWS S3 Bucket to be able to show some of my HTML canvas animations, and never had issues until I created an iFrame for an ad platform that versions using a feed called Celtra.

I tried ?embed=true and target="_blank" mentioned in another question where the policy was SAMEDOMAIN, and not surprisingly neither worked.

Do I need to use a Create Object Lambda Access Point? According to Mozilla, DENY & SAMEORIGIN are the only option.

ALLOW-FROM uri This is an obsolete directive that no longer works in modern browsers. Don't use it. In supporting legacy browsers, a page can be displayed in a frame only on the specified origin uri. Note that in the legacy Firefox implementation this still suffered from the same problem as SAMEORIGIN did — it doesn't check the frame ancestors to see if they are in the same origin. The Content-Security-Policy HTTP header has a frame-ancestors directive which you can use instead.

Answer 1

1. Yes, you have to use Lambda@Edge func to add custom HTTP response headers to AWS S3 bucket.
   But judging by this topic, this one, and this doc, AWS does not add X-Frame-Options header on its own. Therefore your HTML canvas animations should not be blocked in the iframe.

2. If you wish to allow iframing at miltiple locations, the X-Frame-Options is not flexible enough. Use Conrent-Security-Policy (CSP) HTTP header with the frame-ancestors directive.

   Conrent-Security-Policy: frame-ancestors *;
   
   will allow iframing at any locations, while
   
   Conrent-Security-Policy: frame-ancestors example.com friends.com;
   
   allows to embed page have published this header only in example.com and friends.com sites only.

UPDATE

The HTTP header with white list of domains allowed to embed iframe:

`Conrent-Security-Policy: frame-ancestors example.com friends.com allowed_site.net`

must be published by your s3.console.aws.amazon.com/s3/buckets/advancedbanners page. This page should grant the permissions to embed itself.

I am not shure you can to publish CSP header on AWS S3 without Lambda@Edge func. You have to use exactly HTTP header, since frame-ancestors is not supported in the <meta http-equiv="Conrent-Security-Policy" content=" directives_here "> meta tag.

And you have to find a way to stop publishing the X-Frame-Options(XFO) header on AWS S3 because of Safari bug - XFO does not obsolete in favor CSP.