1

All the AWS security tools are bugging me all day about having public S3 bucket access turned on. So I said sure, the only bucket we have that needs public access is our cloudfront bucket, let me fix that and then I can use the new "don't make any of this public what's wrong with you" setting. I followed the AWS docs on this, https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html

So I went in to the cloudfront distro's origin and set it to "Restrict Bucket Access." I had it create a new origin access identity and had it apply it to the bucket. It works. I go check the bucket permissions/policy, and now it says:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AddPerm",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::cloudfront-mycompany-us-west-2/*"
        },
        {
            "Sid": "2",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E22JXXXXXKYVK2"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::cloudfront-mycompany-us-west-2/*"
        }
    ]
}

Which all looks fine. But when I then "Block public access" to that S3 bucket my site goes offline. I looked around in cloudtrail and cloudwatch logs but couldn't see anything that seemed to indicate why.

Has anyone gotten CloudFront working with a non-public S3 bucket and knows what step I'm missing?

1 Answer 1

3

You have an extra statement in there (the top one) that allows "*" to access the bucket's objects. You only need the bottom policy to allow CloudFront to access the objects using an OAI. When you "block all public access", it sees that you have a public entry in there and it might just disable the whole policy instead of just the top part. Remove the first statement, make sure the OAI is the same one as the one associated with your CF distribution and then turn on "block all public access". If CloudFront put it's policy on the bucket automatically, the previous statement was already put on the bucket manually from before.

1
  • You were right! I removed the initial global config and then it revoked correctly without touching cloudfront's access. Thanks very much.
    – mxyzplk
    Jun 1, 2020 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .