Cache Based on Selected Request Headers - CloudFront Behavior for Cloudformation?

Question

I am writing Cloudformation to deploy an ELB origin CloudFront distribution. I have it completed aside from one option that I can't find in the AWS documentation. I am redirecting all traffic to https and because of this I need to set the behavior on my distribution to use "All" or "Whitelist" for "Cache Based on Selected Request Headers". Can this be specified in Cloudformation anywhere? If so how?

The default is None, which is an invalid option and returns the error:

To use SSL with an ELB origin, either forward all headers or whitelist the Host header. If you do not want to forward any headers, change the Origin Protocol Policy to HTTP Only.

Answer 1

In the DefaultCacheBehavior and members of CacheBehaviors, you would need a ForwardedValues that resembles this:

{
  "Cookies" : Cookies,
  "Headers" : [ String, ... ],
  "QueryString" : Boolean,
  "QueryStringCacheKeys" : [ String, ... ]
}

Headers is an array of strings of the headers to forward, e.g. Host.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-forwardedvalues.html

---

The error when you try to use an ELB as an Origin is new (added around January, 2018).

Previously, the configuration would have been accepted, but would not actually work with HTTPS because CloudFront requires that the origin present a valid SSL certificate.

"Valid" means all of these things:

• must be signed by a trusted public CA (thus must not be self-signed)
• must not be expired
• must match either the origin domain name configured in CloudFront or the Host header sent by CloudFront to the origin. (Unless you whitelist the Host header sent by the browser, these two values are the same -- the Host header of the outgoing request is set to the origin domain name.)

That last condition is impossible to meet with an AWS issued ELB hostname as origin unless you forward the Host header and have a cert on the ELB that matches the Host header sent by the browser, because you can't get an SSL cert for a .amazonaws.com subdomain, since that isn't your domain. This also means you can't use the assigned dzczcexample.cloudfront.net hostname in your browser to test HTTPS through to an ELB origin that uses the ELB hostname as the origin domain name -- CloudFront will throw a 502 Bad Gateway error and complain that it could not connect to the origin. What it actually means is that it could not authenticate the origin, because the SSL cert's subject doesn't match the request that CloudFront is trying to forward.