Okay, so let's go ahead and practice using CloudFront,
but first we need to create an S3 bucket.
So in Amazon stream,
I want you to create a bucket called demo
CloudFront-Stephane-v2 and a region, so EU-west-1 is good.
I will leave all public access blocking
and I will scroll down.
Then just click on create my bucket.
So this is the bucket that is going to host our website.
And so click on view details to go into the bucket.
And I'm going to upload now three files into my bucket.
So I will upload my index.html, my beach.jpeg,
and my coffee.jpeg.
So all these files are uploaded.
Okay, we're now done.
And so what I want you to see is that these files,
so if we take, for example, the index.html,
we have two ways of accessing it.
We can either access it using the object URL,
but this is not going to work
because my bucket is not public.
So I'm going to get an access denied.
Or we can say, for example, click on this open button,
which actually generates a pre-signed URL.
And this particular URL
allows me to access my index.html file,
but obviously my coffee.jpeg is not working for here.
So as we can see,
we have some ways of accessing our files in S3.
But we want to allow the access of these files
through CloudFront.
And so to do so what I'm going to do is just go into
the CloudFront service itself.
So I will look for the service named CloudFront,
and we can observe that CloudFront
is a global service that does not require region selection,
because we are deploying a CloudFront distribution
all around the world.
So we're going to create our first distribution
and we need to choose an origin domain.
So here we have different options.
So we have Amazon history, elastic load balancers,
et cetera, et cetera.
We've introduced Amazon S3.
So we're going to choose this demo
CloudFront-Stephane-v2 bucket.
But as you can see,
you could enter here your own
origin domain name if you wanted to.
If you wanted to have a custom HDP origin.
But in this example, we're going to use Amazon S3.
So I just use a drop down and select my S3 bucket.
Now the name of my origin is going to be like this,
and we're going to create a OAI.
So it's an origin access identity.
And this is only available because
we are using an S3 bucket access.
So here we have to create an OAI,
which is what I'm going to do
is I'm going to click on create OAI.
This is going to create this OAI name right here.
I will click on create.
And in here I'm able to choose this newly created OAI.
So what's going to happen is that
CloudFront is going to access my S3 bucket
using this identity.
And we can edit the bucket policy of the S3 bucket
to allow real access to the OAI.
So let's, yes, let's update the bucket policy.
And what we can do is we can check that
if we go right now into permissions,
scroll down and look at the bucket policy.
Well, currently the bucket policy is empty.
So we are going to scroll down
and then we are not going to change
any of these settings for now.
So we're good.
Let's scroll down all the way.
And the default route object is the file name
that you want to return to your request
if we're using the root URL.
So we're just going to here here, index.html,
and we're good to go.
Now let's click on create distribution
and the distribution is now deploying.
This takes about five minutes.
So let me pause the video.
So my distribution is now created
and I can copy the distribution domain name,
enter in a new tab and press enter.
And as we can see, we get I really love coffee, hello world,
and then our coffee.jpeg file and so on.
So that means that the CloudFront distribution is working.
I can still not access my files directly
by using the URL in Amazon S3.
The only way I can access my files is by using CloudFront.
So CloudFront is distributing my content from Amazon S3.
So we can do beach.jpeg, for example,
and yes, we can see the beach.jpeg file
or coffee.jpeg obviously.
But the cool thing about it is
that now these files are caged.
I've crashed.
So that means that if I go back to my beach.jpeg,
it's actually not being served from Amazon S3 anymore,
it's served directly from a CloudFront edge location.
Same if I went back to my index HTML.
Now the request does not make it go
all the way through to Amazon S3.
It is cashed yet again in an education for CloudFront.
So this really shows the power
of using a CloudFront distribution on top of Amazon S3
because now this content is going to be available globally
with low latency.
The last thing I want to check is that
if we go back to our permissions,
as you can see the buckets policy was empty.
But if I refresh my page right now
and have a look,
the bucket policy now is not empty.
And it contains a statement that allows the principle.
And this is a CloudFront origin access identity principle
to do get object on any resource in my S3 buckets.
And we can have a look at this identity.
So on the left hand side,
if I go and scroll down
and look at origin access identities,
we can find here the origin access identity
that we have created
that is associated with our CloudFront distribution.
And that is allowing us, CloudFront mostly,
to get the content from the S3 buckets
and then distribute it as a public URL.
So that's it for this lecture.
I hope you liked it and I will see you in the next lecture.