aws cloudfront - 使用 S3 拒絕訪問

Question

我創建了一個雲端分發和 S3 存儲桶。
我在訪問 Cloudfront url asdf123456.cloudfront.net時遇到Access Denied訪問錯誤

我嘗試在我的 cloudformation 模板中添加custom error message ，但仍然無法正常工作。

我在 Cloudformation 中的 Json 模板

{
    "AWSTemplateFormatVersion": "2010-09-09",

    "Parameters": {
        "S3BucketName": {
            "Type": "String",
            "Default": "test-server-dev"
        },
        "S3BucketWebName": {
          "Type": "String",
          "Default": "test-web-dev"
        },
        "CloudfrontDistributionOriginId": {
          "Type": "String",
          "Default": "test_dev"
        }
    },

    "Resources": {
      "S3BucketWeb": {
        "Type": "AWS::S3::Bucket",
        "Properties": {
          "BucketName": {
              "Ref": "S3BucketWebName"
           }
        }
      },
      "CloudfrontDistributionWeb": {
        "Type" : "AWS::CloudFront::Distribution",
        "Properties" : {
            "DistributionConfig" : {
              "CustomErrorResponses" : [
                {
                  "ErrorCachingMinTTL" : 300,
                  "ErrorCode" : 403,
                  "ResponseCode" : 200,
                  "ResponsePagePath" : "/index.html"
                }
              ],
              "DefaultCacheBehavior": {            
                  "AllowedMethods" : ["GET", "HEAD"],
                  "CachedMethods" : ["GET", "HEAD"],
                  "CachePolicyId" : "658327ea-f89d-4fab-a63d-7e88639e58f6",
                  "Compress" : false,
                  "TargetOriginId" : {
                    "Ref": "S3BucketWebName"
                  },
                  "ViewerProtocolPolicy" : "redirect-to-https"
              },
              "DefaultRootObject" : "index.html",
              "Enabled" : true,
              "HttpVersion": "http2",
              "IPV6Enabled" : true,
              "Origins" : [
                {
                  "ConnectionAttempts" : 3,
                  "ConnectionTimeout" : 10,
                  "DomainName" : {
                    "Fn::GetAtt": [
                      "S3BucketWeb",
                      "DomainName"
                    ]
                  },
                  "Id" : {
                    "Ref": "S3BucketWebName"
                  },
                  "S3OriginConfig": {
                    "OriginAccessIdentity" : ""
                  }
                }
              ],
              "Restrictions" : {
                "GeoRestriction" : {
                  "RestrictionType" : "none"
                }
              },
              "ViewerCertificate" : {
                "CloudFrontDefaultCertificate" : true
              }
            }
        }
      }
    }
  }

更新

桶策略

{
    "Version": "2008-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EBJE9SUE3W57Q"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::test-web-dev/*"
        }
    ]
}

Answer 1

我無法正確理解這個問題，但如果您在上傳雲形成模板時拒絕 s3 訪問，那么您可能缺少允許執行此類操作然后將其附加到形成模板本身的安全組或 IAM 角色。