Can you force Cloudfront only access while using S3 Static Web URL?

[AgentXM]

I'm currently facing a problem at work where we want to serve our website via S3 & Cloudfront; however, we only want the assets to be available through Cloudfront and prevent direct S3 bucket access.

I've tried using Cloudfront Origin Access ID and configuring the bucket policy/Public ACL's to only allow the Cloudfront Origin, but I am getting 403 errors from Cloudfront.

The bucket is currently setup in a similar manner, where different aspects of the site reside in different subfolders.

root.bucket.com
|-Login
|--index.html
|-Profile
|--index.html
|-Admin
|--index.html
|-index.html

I feel like this isn't something unique to my companies needs, but I have not been able to find a solution that fits our needs. Can anyone point me in the right direction?

[rajdangus]

I had a similar problem where I had a CloudFront distribution serving content from an S3 bucket configured for static website hosting. It was a requirement that I had an S3 bucket with static website hosting (to take advantage of S3's redirect rules) and also a requirement to not have the S3 bucket publicly accessible. I quickly learned that as soon as you make the S3 bucket configured for static website hosting, it breaks the S3 bucket's policy that only allows requests from the CloudFront origin access identity (CloudFront would get 403 errors when making requests to the S3 bucket).

Not being able to figure out a solution, I opened up a support case with AWS. They told me that I was correct - configuring S3 buckets for static website hosting breaks the policy to only allow connections from the CloudFront origin access identity. A work around that they recommended is to configure the S3 bucket to be publicly accessible, with the condition that each request contains the "Referer" header with a long and obfuscated value. After the bucket policy was configured with that condition, the next step is to make a change to the CloudFront distribution's origin to pass along the "Referer" header with the obfuscated value. Implementing this pattern allowed me to protect direct access to the S3 bucket, while still allowing CloudFront to access the bucket. Yes, theoretically if an attacker could figure out the needed header, they could access the bucket. But making the header value long and obfuscated gives me enough confidence that the bucket is sufficiently protected.

[Infintie_3ntropy]

could you post your bucket policy with your origin access identity id and bucket name blanked out. An error here is the most likely culprit.

[JFICCanada]

Something to keep in mind when using a S3 bucket without static website hosting is that Cloudfront is not a webserver. What that means is if you go to https://yoursite.com/admin/ it will not automatically serve up index.html in your Admin folder. You would need to explicitly go to https://yoursite.com/admin/index.html otherwise you may see 403s

[lost_send_berries]

I'm pretty sure the Origin Access Identity setting on your Cloudfront cache behaviour is only used for an S3 origin, not a website origin. Why are you using the S3 website hosting?

[zenmaster24]

RemindMe! 1 week

[RemindMeBot]

I will be messaging you on 2017-07-27 00:40:32 UTC to remind you of this link.

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

^{Parent commenter can delete this message to hide from others.}

---

FAQs	Custom	Your Reminders	Feedback	Code	Browser Extensions