How to add Origin Access Identity to distribution?

Question

AWS have updated their ui but not documentatio/videos for it. All docs specifying that you can you can choose OAI in Distribution > Edit > Origins and Origins Groups. But that fields doesn't exist there anymore.

UI or CLI way to update it would be appreciated.

Answer 1

This works in the UI:

1. Go to CloudFront and select your distribution
2. Choose the tab "Origins and Origin Groups"
3. Create origin / select the existing origin
4. Select an S3 bucket as "Origin Domain Name"
5. Choose "yes" for the option Restrict Bucket Access
6. Create a New Identity (for a new OAI) or use an existing one
7. Optionally "Grant Read Permissions on Bucket" for the OAI.

Answer 2

Make sure you have identity to assign 1st. Go there, create one or plan to re-use already created if you have any.

Then go to your distributions, select origin you want to update & go into edit form. Select to us origin access identity (OAI). and if you want CloudFront to update your S3 policy, select yes to update the bucket policy

After saving this, you can go to S3's bucket and inside Permissions tab scroll to Bucket Policy, it should mention something about origin access identity (OAI).

{
    "Version": "2008-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E2LNLBSIODD9DQ"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::demo-s3-cdn/*"
        }
    ]
}

This view is inside S3 bucket Permissions tab:

By the way, CloudFormation does not support this, at least for now.