s3 和 cloudfront 上的静态托管问题 [OAI]

Question

I created an s3 bucket, with static hosting enabled. I created a cloudfront distribution with an access identity FOO .

My goal is to have a cloudfront distribution that can access s3 (including paths) in order to serve a static website.

The policy on my bucket is:

{
    "Version": "2012-10-17",
    "Id": "...",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity FOO"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*"
        }
    ]
}

I changed the origin name on the cloufront distribution to point to my s3 hosting address:

my-bucket.s3-website-my-region-1.amazonaws.com

If I now visit the cloudfront address, I get Access Denied 403 .

If I change the permissions of the index.html file on s3 in order to grant read and list permissions to everyone, then it all works.

But, this feels like a hack, not to mention that I have to post-modify permissions after deploying and all.

Is it possible to have static hosting on s3 that is only served through cloudfront with OAI?

Answer 1

When using Amazon CloudFront to provide access to an Amazon S3 bucket using OAI, simply select the bucket in CloudFront rather than pointing to the website URL.

The documentation says: "For Origin domain, select the bucket that you created."

See: Use CloudFront to serve a static website hosted on Amazon S3

If you want the root URL to default an index.html file, then you will need to configure this behaviour on the CloudFront Distribution rather than relying on S3 doing it for you.

See: Specifying a Default Root Object - Amazon CloudFront

Answer 2

Along with s3:GetObject use listbucket permission as well then it works as expected

{
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity FOO"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*"
        },
        {
            "Sid": "2",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity FOO"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::my-bucket"
        }
    ]
}