CloudFront - “S3 bucket access” setting

Product Support

AI-generated summary

The discussion revolves around configuring a CloudFront distribution for an S3 bucket. Ethsim2 is trying to set up a distribution with access to nodes in both North America and Europe. While configuring, they encountered the “S3 bucket access” setting with three options: public, OAC (Origin Access Control), and OAI (Origin Access Identity). Ethsim2 found that the OAI option didn’t work, as it overwrote the bucket policy. They are now considering the OAC option, which supports SSE-KMS, but are unsure why AWS requires manual changes to the S3 bucket policy. Ethsim2 is seeking recommendations on the policy JSON, specifically for IAM, and wondering if the S3 bucket policy is irrelevant in this case.

1

Hi,

I’ve created an S3 bucket in the us-west-1 region near to my server in Phoenix NAP. However, since i’m based in UK, i’d like to create a working Cloud Front distribution for the S3 bucket for nodes in both the North America and Europe region.

However, whilst configuring the distribution i came across the bucket access setting, which had 3 options

  • public
  • OAC (Origin Access Control)
  • OAI (Origin Access Identity)
The OAC option alerted that

IMG_7220
IMG_72201206×849 225 KB

i should modify the s3 discourse policy template further to work with CloudFront.

However, the OAI option didn’t work in my instance, because

it seemed to overwrite the bucket policy with the enclosed

IMG_7219
IMG_72191206×2622 196 KB

Is OAC a reasonable option, and deos anyone have any recommendations about the policy JSON?

3

Given that OAC supports SSE-KMS

and the implementation relies on the administrator changing the S3 bucket policy manually, i’m not sure why AWS require this?

the policy JSON i was referring to is for IAM. However, the S3 bucket policy appears to be irrelevant?