EC2 Elastic Load Balancer를 HTTP에서 HTTPS로 리디렉션

EC2 Elastic Load Balancer를 HTTP에서 HTTPS로 리디렉션

---

모든 HTTP 요청을 ELB의 https 요청으로 리디렉션하고 싶습니다 . 두 개의 EC2 인스턴스가 있습니다. 서버에 nginx를 사용하고 있습니다. 나는 성공하지 않고 nginx conf 파일을 다시 작성하려고 시도했습니다. 나는 그것에 대한 몇 가지 조언을 원합니다.

---

AWS Application Load Balancer는 이제 네이티브 HTTP에서 HTTPS 로의 리디렉션을 지원합니다.

콘솔에서이를 활성화하려면 다음을 수행하십시오.

1. EC2의로드 밸런서로 이동하여 "리스너"탭
2. HTTP 리스너에서 "규칙보기 / 편집"을 선택하십시오.
3. 기본 규칙을 제외한 모든 규칙 삭제 (하단)
4. 기본 규칙 편집 : 작업으로 "Redirect to"를 선택하고 모든 항목을 기본값으로두고 "443"을 포트로 입력합니다.

여기에 설명 된대로 CLI를 사용하여 동일한 작업을 수행 할 수 있습니다 .

다음과 같이 Listener 개체를 설정해야하는 Cloudformation에서도이 작업을 수행 할 수 있습니다.

  HttpListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: HTTP
      DefaultActions:
      - Type: redirect 
        RedirectConfig:
          Protocol: HTTPS
          StatusCode: HTTP_301
          Port: 443

여전히 Classic Load Balancer를 사용하는 경우 다른 구성에서 설명한 NGINX 구성 중 하나로 이동하십시오.

---

ELB는 X-Forwarded-Proto헤더를 설정 합니다.이를 사용하여 원래 요청이 HTTP에 대한 것인지 감지하고 HTTPS로 리디렉션 할 수 있습니다.

serverconf 에서 이것을 시도 할 수 있습니다 .

if ($http_x_forwarded_proto = 'http') {
    return 301 https://yourdomain.com$request_uri;
}

ELB 문서를 살펴보십시오 .

---

내 상황에서 HTTPS는 ELB가 전적으로 처리했으며 소스 도메인을 미리 몰랐기 때문에 동일한 문제가 발생하여 다음과 같은 작업을 수행했습니다.

server {
  listen 81;
  return 301 https://$host$request_uri;
}

server {
  listen 80;
  # regular server rules ...
}

그리고 물론 ELB 'https'는 인스턴스 포트 80을 가리키고 'http'경로는 인스턴스 포트 81을 가리 킵니다.

---

The Amazon Elastic Load Balancer (ELB) supports a HTTP header called X-FORWARDED-PROTO. All the HTTPS requests going through the ELB will have the value of X-FORWARDED-PROTO equal to “HTTPS”. For the HTTP requests, you can force HTTPS by adding following simple rewrite rule. For me it works fine!

Apache

You can add following lines in your .htaccess file:

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI}

Or if you use vhost.conf for managing multiple domains in same EC2 web server then you can add following to the vhost.conf (add it to the domain you want to use https for it):

<VirtualHost *:80>
...
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI}
...
</VirtualHost>

IIS

Install IIS Url-Rewrite module, using the configuration GUI add these settings:

<rewrite xdt:Transform="Insert">
<rules>
<rule name="HTTPS rewrite behind ELB rule" stopProcessing="true">
<match url="^(.*)$" ignoreCase="false" />
<conditions>
<add input="{HTTP_X_FORWARDED_PROTO}" pattern="^http$" ignoreCase="false" />
</conditions>
<action type="Redirect" redirectType="Found" url="https://{SERVER_NAME}{URL}" />
</rule>
</rules>
</rewrite>

Read more here

---

It may not be the solution you might be looking for, but another option could be to use AWS CloudFront in addition to ELB. CloudFront gives the option to redirect all incoming HTTP traffic to HTTPS.

---

I had strange problem with nginx and ELB configuration. My setup included 3 different services inside one nginx behind ELB. And I had mixed content issue: when your request to ELB is https, but inside ELB http only, and server create relative path to static using http, so browser fails with 'mixed content' issue. And I must create solution for both http/https work without any redirects.

Here is config located in nginx/conf.d/ folder:

# Required for http/https switching
map $http_x_forwarded_port $switch {
  default   off;
  "80"    off;
  "443"   on;
}

This means that we will have knowledge what real client protocol is. As you can see, we will have it in $switch var. And at this moment you use this in all location where you need it:

location ~ /softwareapi/index.php {
  fastcgi_param HTTPS $switch;
  .. other settings here ..
}

With HTTPS setting php application will automatically detect right protocol and carefully build relative path for preventing mixed content issue.

Best regards.

---

The htaccess solutions above caused ELB health check to fail. I had some trouble finding the solution until I discovered an article online in which someone had the same issues I had. His solution was to add this to the beginning of the htaccess file instead:

RewriteEngine on 
RewriteCond %{HTTP:X-Forwarded-Proto} ^http$
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

To allow this and other local requests over HTTP while redirecting external requests through the ELB to HTTPS, adjust the rewrite condition to match on http instead of a negative match on https.

Source: Redirecting HTTP to HTTPS with AWS and ELB

---

Based on @Ulli's answer If you want to configure it using Terraform, here is an example >

resource "aws_alb_listener" "web" {
  load_balancer_arn = "${aws_alb.web.arn}"

  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

Source

---

Create a file .ebextensions/00_forward_http_to_https.config with the following content:

files: 
  /tmp/deployment/http_redirect.sh:
    mode: "000755"
    content: |
      APP_URL=`/opt/elasticbeanstalk/bin/get-config environment --output yaml | grep -oP 'APP_URL: \K([^\s)\"](?!ttp:))+'`
      sed -ie 's@$proxy_add_x_forwarded_for;@$proxy_add_x_forwarded_for;\n        if ($http_x_forwarded_proto = 'http') { return 301 https://'"$APP_URL"'$request_uri; }@' /tmp/deployment/config/#etc#nginx#conf.d#00_elastic_beanstalk_proxy.conf

container_commands:
  http_redirect:
    command: "/tmp/deployment/http_redirect.sh"

Make sure to set the APP_URL environment variable from the AWS management console beforehand.

참고 URL : https://stackoverflow.com/questions/24603620/redirecting-ec2-elastic-load-balancer-from-http-to-https