CloudFront - “S3 bucket access” setting

Support
1

Hi,

I’ve created an S3 bucket in the us-west-1 region near to my server in Phoenix NAP. However, since i’m based in UK, i’d like to create a working Cloud Front distribution for the S3 bucket for nodes in both the North America and Europe region.

However, whilst configuring the distribution i came across the bucket access setting, which had 3 options

  • public
  • OAC (Origin Access Control)
  • OAI (Origin Access Identity)
The OAC option alerted that

IMG_7220
IMG_72201206×849 225 KB

i should modify the s3 discourse policy template further to work with CloudFront.

However, the OAI option didn’t work in my instance, because

it seemed to overwrite the bucket policy with the enclosed

IMG_7219
IMG_72191206×2622 196 KB

Is OAC a reasonable option, and deos anyone have any recommendations about the policy JSON?

3

Given that OAC supports SSE-KMS

and the implementation relies on the administrator changing the S3 bucket policy manually, i’m not sure why AWS require this?

the policy JSON i was referring to is for IAM. However, the S3 bucket policy appears to be irrelevant?