All the AWS security tools are bugging me all day about having public S3 bucket access turned on. So I said sure, the only bucket we have that needs public access is our cloudfront bucket, let me fix that and then I can use the new "don't make any of this public what's wrong with you" setting. I followed the AWS docs on this, https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
So I went in to the cloudfront distro's origin and set it to "Restrict Bucket Access." I had it create a new origin access identity and had it apply it to the bucket. It works. I go check the bucket permissions/policy, and now it says:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AddPerm",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::cloudfront-mycompany-us-west-2/*"
},
{
"Sid": "2",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E22JXXXXXKYVK2"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::cloudfront-mycompany-us-west-2/*"
}
]
}
Which all looks fine. But when I then "Block public access" to that S3 bucket my site goes offline. I looked around in cloudtrail and cloudwatch logs but couldn't see anything that seemed to indicate why.
Has anyone gotten CloudFront working with a non-public S3 bucket and knows what step I'm missing?