As the subject line mentions. I have an S3 Website bucket which has only 1 policy allowing the CloudFront distribution's OAI that it is tethered, to have the "GetObject" action on all objects within the bucket in question.
The policy on the bucket is questions looks like this:

    "Version": "2012-10-17",
    "Statement": [
            "Sid": "2",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity <OAI-ID>"
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<my-s3-website-bucket>/*"

The bucket is set up to serve content, a basic index.html only through CloudFront. I have enabled a CloudTrail trail for Data Events(read,write) on this S3 bucket and S3 Bucket website is being served as expected by CloudFront, however CloudTrail shows no logs for any GetObject API calls by the CloudFront OAI S3 special user when I access it via CloudFront i.e. by accessing the CloudFront distribution URL on a browser which in turn has to GET and serve the file to me on the browser.

When I execute a GetObject action via CLI using:

aws s3 cp s3://<my-s3-website-bucket>/index.html .

Cloudtrail logs show API calls for that.

So my question is that if the CloudFront OAI user is using GetObject action to serve bucket content via CloudFront why isn't it getting logged in CloudTrail? Am I missing something here?

Things I have confirmed so far: 1) Bucket policy only allows CF OAI to GetObject, but I can do it via CLI because I'm the bucket owner. 2) CloudFront distribution is setup and working properly. 3) CloudTrail has S3 Data Event(read,write) setup for the bucket using proper input i.e. bucket name field is set and no prefix(which means all object level API calls within bucket will be recorded by CT).

Happy to provide more information. Appreciate the help in advance. P.S This is not a production system or for any test app just for my knowledge.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.