This is a fork of strapi-provider-upload-aws-s3 that adds CloudFront CDN support and ensures files are uploaded with private ACL for security.

Install via

npm install strapi-provider-upload-aws-s3-cloudfront-private-acl

or

yarn install strapi-provider-upload-aws-s3-cloudfront-private-acl

config/plugins.js:

module.exports = ({ env }) => {
  //...
  upload: {
    provider: 'strapi-provider-upload-aws-s3-cloudfront-private-acl',
    providerOptions: {
      accessKeyId: env('AWS_S3_KEY'),
      secretAccessKey: env('AWS_S3_SECRET'),
      region: env('AWS_S3_REGION'),
      params: {
        Bucket: env('AWS_S3_BUCKET'),
      },
      // Fully qualified URL with trailing forwardslash:
      cdn: env('CLOUDFRONT_URL') // eg: "https://abc123tuvwxyz.cloudfront.net/"
    },
  },
  //...
};

config/middlewares.js:

module.exports = [
  {
    name: "strapi::security",
    config: {
      contentSecurityPolicy: {
        useDefaults: true,
        directives: {
          "connect-src": ["'self'", "https:"],
          "img-src": [
            "'self'",
            "data:",
            "blob:",
            "abc123tuvwxyz.cloudfront.net", // Enter your cloudfront domain here
          ],
          "media-src": [
            "'self'",
            "data:",
            "blob:",
            "abc123tuvwxyz.cloudfront.net", // Enter your cloudfront domain here
          ],
          upgradeInsecureRequests: null,
        },
      },
    },
  },
  "strapi::errors",
];