Struggling setting up permission policy for S3 bucket behind CloudFront

Question

I've spent several hours reading documentation and trying different approaches, and I can't get it to work.
I'm trying to keep my S3 bucket private while giving read access to public files through CloudFront and read/write access to private files as well as write access to public files to logged in users.
So I wrote this:

```
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "PublicReadForPublicFolder",
			"Effect": "Allow",
			"Principal": "*",
			"Action": "s3:GetObject",
			"Resource": "arn:aws:s3:::BUCKET_NAME/public/*"
		},
		{
			"Sid": "PrivateWriteForPublicFolder",
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity/THE_DISTRIBUTION_ORIGIN_ACCESS_ID"
			},
			"Action": [
				"s3:PutObject"
			],
			"Resource": "arn:aws:s3:::BUCKET_NAME/public/*"
		},
		{
			"Sid": "PrivateReadWriteForPrivateFolder",
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity/THE_DISTRIBUTION_ORIGIN_ACCESS_ID"
			},
			"Action": [
				"s3:GetObject",
				"s3:PutObject"
			],
			"Resource": "arn:aws:s3:::BUCKET_NAME/private/*"
		}
	]
}
```

And when I try to save I get this error: 
```
Unknown Error
An unexpected error occurred.
API response
Invalid principal in policy
```

If this is not how I'm supposed to write the policy, then how?
Thanks in advance.

Accepted Answer

Please refer this [re:Post Knowledge Center Article](https://repost.aws/knowledge-center/cloudfront-access-to-amazon-s3).

Under bucket policy, principal would be something like ""AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EAF5XXXXXXXXX""

Refer **Example S3 bucket policy that allows read-only access to an OAI and an OAC** section at [Restricting access to an Amazon S3 origin](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html)

Answer

You need something like this on your policy. You dont grant public access to your bucket if you only want CloudFront to have access

```
{
    "Version": "2012-10-17",
    "Statement": {
        "Sid": "AllowCloudFrontServicePrincipalReadOnly",
        "Effect": "Allow",
        "Principal": {
            "Service": "cloudfront.amazonaws.com"
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::/*",
        "Condition": {
            "StringEquals": {
                "AWS:SourceArn": "arn:aws:cloudfront:::distribution/"
            }
        }
    }
}
```

and for your KMS Key if using one then

```
{
    "Sid": "AllowCloudFrontServicePrincipalSSE-KMS",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam:::root",
        "Service": "cloudfront.amazonaws.com"
    },
    "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey*"
    ],
    "Resource": "*",
    "Condition": {
            "StringEquals": {
                "AWS:SourceArn": "arn:aws:cloudfront:::distribution/"
            }
        }
}
```

Setup OAC

To create an origin access control
1. Sign in to the AWS Management Console and open the CloudFront console at https://console.aws.amazon.com/cloudfront/v3/home.
2. In the navigation pane, choose Origin access.
3. Choose Create control setting.
4. On the Create control setting form, do the following:
5. In the Details pane, enter a Name and (optionally) a Description for the origin access control.
6. In the Settings pane, we recommend that you leave the default setting (Sign requests (recommended)). For more information, see Advanced settings for origin access control.
7. Choose S3 from the Origin type dropdown.
8. Choose Create. After the OAC is created, make note of the Name. You need this in the following procedure.

To add an origin access control to an S3 origin in a distribution
Open the CloudFront console at https://console.aws.amazon.com/cloudfront/v3/home.

1. Choose a distribution with an S3 origin that you want to add the OAC to, then choose the Origins tab.
2. Select the S3 origin that you want to add the OAC to, then choose Edit.
3. From the Origin access control dropdown menu, choose the OAC that you want to use.
4. Choose Save changes.

The distribution starts deploying to all of the CloudFront edge locations. When an edge location receives the new configuration, it signs all requests that it sends to the S3 bucket origin.

Answer

Hi,

I don't think that `"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity/THE_DISTRIBUTION_ORIGIN_ACCESS_ID"` is a valid principal in the sense that it contains space characters, which mark a separation for IAM.  So, rather try something like `"AWS": "arn:aws:iam::cloudfront:user/CloudFrontOriginAccessIdentity/THE_DISTRIBUTION_ORIGIN_ACCESS_ID"`

See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-quotas-names

```
Names of users, groups, roles, policies, instance profiles, and server certificates 
must be alphanumeric, including the following common characters: plus (+), 
equal (=), comma (,), period (.), at (@), underscore (_), and hyphen (-).
```
Best,
Didier

Struggling setting up permission policy for S3 bucket behind CloudFront

Relevant content