Enable HTTPS for (only) a Subdomain that loads an S3 Bucket | IAM?

Question

Hello,

My client has `domain.com` hosted on another hosting company.

They are currently having `sub.domain.com` loads a bucket here, using CNAME record value like `s0m3th1ng.cloudfront.net`

It worked perfectly for around a decade, but now we want to load the subdomain over HTTPS. `domain.com` on the other hosting, has HTTPS activated.

How could one achieve that?

My client gave me 'database admin' permission, which allow me to see buckets and the files. But, I can't find `sub.domain.com` written anywhere. Can you also tell me what permission(s) my client should give me to safely set up this matter?

Thank you.

Answer

You will need permission in ACM to create a certificate for `sub.domain.com`. You will also need permissions in CloudFront to add the certificate to the distribution and add alternate domain of `sub.domain.com` to the distribution. See: [Using alternate domain names and HTTPS](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-alternate-domain-names.html).

In response to the comment below: There are a couple of AWS Manage policies that they could assign to you. 
See: [CloudFrontFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/CloudFrontFullAccess.html) and [AWSCertificateManagerFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCertificateManagerFullAccess.html).

Those two policies are not least privileged but they could start with these and add Resources and Conditions to restrict you to your specific task by creating a customer-managed policy.

Enable HTTPS for (only) a Subdomain that loads an S3 Bucket | IAM?

Relevant content