Private S3 bucket behind CloudFront (Origin Access Control)

The problem

A static site or asset store should be reachable through CloudFront and nowhere else. Making the bucket public or turning on S3 static website hosting works, but it bypasses CloudFront's caching, WAF rules and signed URLs, and it means turning off Block Public Access.

With Origin Access Control (OAC), CloudFront signs its requests to the S3 REST endpoint as the service principal cloudfront.amazonaws.com. The bucket policy grants that principal read access, but only for requests made on behalf of one distribution. The bucket stays private and Block Public Access stays on. OAC replaces the older origin access identity (OAI), which AWS now calls legacy; OAC adds SSE-KMS support, all Regions including newer opt-in Regions, and dynamic requests such as PUT.

The policies

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCloudFrontOacRead",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudfront.amazonaws.com"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceArn": "arn:aws:cloudfront::111122223333:distribution/EDFDVBD6EXAMPLE"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCloudFrontOacRead",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudfront.amazonaws.com"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceArn": "arn:aws:cloudfront::111122223333:distribution/EDFDVBD6EXAMPLE"
        }
      }
    },
    {
      "Sid": "AllowLegacyOaiReadUntilCutover",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity <oai-id>"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*"
    }
  ]
}

Before you start

• A CloudFront distribution whose origin is the bucket's REST endpoint (amzn-s3-demo-bucket.s3.<region>.amazonaws.com), not the S3 website endpoint.
• S3 Object Ownership set to Bucket owner enforced (the default for new buckets), which AWS requires for OAC unless you still need ACLs.
• If objects use SSE-KMS: permission to edit the KMS key policy. If the bucket already has a policy (for example the HTTPS and organization denies), merge rather than replace; both are compatible with OAC.

Deploy it step by step

1. Add the bucket policy before switching the origin. AWS recommends granting access first and attaching the OAC second, so the distribution never sends signed requests that the bucket refuses. Merge the statement into the current policy, validate, apply.

   aws s3api get-bucket-policy --bucket amzn-s3-demo-bucket --query Policy --output text > current.json
   aws accessanalyzer validate-policy --policy-type RESOURCE_POLICY --validate-policy-resource-type AWS::S3::Bucket --policy-document file://bucket-policy.json
   aws s3api put-bucket-policy --bucket amzn-s3-demo-bucket --policy file://bucket-policy.json

2. Let CloudFront use the KMS key (SSE-KMS only). S3 decrypts SSE-KMS objects on CloudFront's behalf, so the key policy (not the bucket policy) must allow the CloudFront service principal. Add a statement with Principal {"Service": "cloudfront.amazonaws.com"}, Action kms:Decrypt, Resource "*" (in a key policy that means this key) and the same StringEquals aws:SourceArn condition on the distribution ARN. AWS's documented statement also lists kms:Encrypt and kms:GenerateDataKey*, which matter only if viewers upload through CloudFront. SSE-S3 objects need nothing here.

   aws kms get-key-policy --key-id <key-id> --policy-name default --output text > key-policy.json
   aws kms put-key-policy --key-id <key-id> --policy-name default --policy file://key-policy.json

3. Create the OAC and attach it to the origin. Create the OAC with signing behavior always (the console's Sign requests option), then edit the distribution config: set the origin's OriginAccessControlId, clear OriginAccessIdentity if one is set, and rename ETag to IfMatch as the CLI requires. When migrating from OAI, apply the temporary two-statement policy before this step and return to the single-statement policy once the distribution is deployed.

   aws cloudfront create-origin-access-control --generate-cli-skeleton yaml-input > origin-access-control.yaml
   aws cloudfront create-origin-access-control --cli-input-yaml file://origin-access-control.yaml
   aws cloudfront get-distribution-config --id EDFDVBD6EXAMPLE --output yaml > dist-config.yaml
   aws cloudfront update-distribution --id EDFDVBD6EXAMPLE --cli-input-yaml file://dist-config.yaml

4. Set a default root object. Set DefaultRootObject (for example index.html) in the distribution settings. It only applies to the root URL; CloudFront does not serve index.html for /docs/ the way an S3 website endpoint would, so sites with directory-style URLs need a CloudFront Function or Lambda@Edge to rewrite them.

Verify it without changing anything

These checks only read state, simulate, or use dry runs, so they are safe to run in any account. Exact error wording varies by service and over time.

aws cloudfront get-distribution-config --id EDFDVBD6EXAMPLE --query 'DistributionConfig.Origins.Items[].[Id,DomainName,OriginAccessControlId,S3OriginConfig.OriginAccessIdentity]' --output table
aws cloudfront get-origin-access-control --id <oac-id> --query 'OriginAccessControl.OriginAccessControlConfig.[SigningBehavior,OriginAccessControlOriginType]'
aws cloudfront get-distribution --id EDFDVBD6EXAMPLE --query Distribution.Status

curl -sI https://<distribution-domain>.cloudfront.net/index.html
curl -sI https://amzn-s3-demo-bucket.s3.<region>.amazonaws.com/index.html
curl -sI https://<distribution-domain>.cloudfront.net/does-not-exist.html

aws s3api get-bucket-policy-status --bucket amzn-s3-demo-bucket
aws s3api get-public-access-block --bucket amzn-s3-demo-bucket

Common mistakes and troubleshooting

Limitations and production considerations

• The policy controls how CloudFront reaches the bucket, not who can reach CloudFront. Anything the distribution serves is public unless you add signed URLs or cookies, WAF rules or geographic restrictions.
• The grant covers every object in the bucket. Keep only publishable files in the origin bucket, or scope the Resource to a prefix such as amzn-s3-demo-bucket/site/*.
• OAC doesn't support origin redirects from Lambda@Edge, and S3 Multi-Region Access Point origins need a different OAC setup; check the CloudFront guide before using either.

Official AWS documentation

• Restrict access to an Amazon S3 origin (CloudFront OAC)
• Blocking public access to your Amazon S3 storage
• Specify a default root object (CloudFront)
• GetObject (Amazon S3 API Reference)
• Website endpoints (Amazon S3)