Files uploaded with CloudFront 403 error when access Root account via AWS Console

Question

Uploading files through CloudFront to s3 bucket via a CloudFront Origin Access Identity runs successfully, however properties of the uploaded files are unable to be modified and some meta-data is unable to be accessed by the root user of my AWS account. I am able to get the files through the CloudFront endpoint, however I do not understand why I am not able to modify or access some fields of the uploaded files through my AWS root account via the AWS Management Console.

The default ACL in the s3 bucket is for the root user account as can be seen below:

I added in a second policy to my bucket just to ensure that the root user has explicit access to the files. The full bucket policy can be seen below:

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity 00000000000000"
                ]
            },
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket/stuff/",
                "arn:aws:s3:::my-bucket/stuff/*",
                "arn:aws:s3:::my-bucket/other-stuff/",
                "arn:aws:s3:::my-bucket/other-stuff/*"
            ]
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::000000000000:root"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-bucket/stuff/",
                "arn:aws:s3:::my-bucket/stuff/*",
                "arn:aws:s3:::my-bucket/other-stuff/",
                "arn:aws:s3:::my-bucket/other-stuff/*"
            ]
        }
    ]
}

When I view a file that I have uploaded through CloudFront I am receiving a Access Denied for numerous options on the file overview tab:

I am also receiving more Access Denied from the file properties tab on the same file:

Answer 1

You need to pass ACL "Bucket-owner-full-control" with the PUT/POST call you're making with CloudFront link and also modify the Bucket policy for CloudFront to allow you PutobjectACL.