CloudFront Distribution S3 AccessDenied

Question

I created a CloudFront distribution and an AWS certificate, then connected an S3 Bucket.gz file that serves as an application container; however, when I tried to access the application, it threw an exception. AccessDenied AccessDenied Access Denied Q6J6B3V91X81WF49 fdghjgklj;lkjhgsrhtjykkfkykyrkykkkktkdkjdjthherthwr3rw3/HostId>

Answer

![Enter image description here](/media/postImages/original/IMgjsWy9whQQeE_-rYqzLeUQ)

![Enter image description here](/media/postImages/original/IMyJTmzq2CSzuR311k87_EYg)

Answer

Thank you for your response

I can access.jpg and.html files, but not.gz image file, which are application image file. referring to ECS

Answer

Hello.  
Do you mean using S3 as the CloudFront origin?  
In such cases, a possible cause of access denial is that the S3 bucket policy is not set correctly.  
Try updating the bucket policy by setting the OAC described in the following document.  
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html  
The bucket policy allowing reads is as follows.  
```
{
    "Version": "2012-10-17",
    "Statement": {
        "Sid": "AllowCloudFrontServicePrincipalReadOnly",
        "Effect": "Allow",
        "Principal": {
            "Service": "cloudfront.amazonaws.com"
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::/*",
        "Condition": {
            "StringEquals": {
                "AWS:SourceArn": "arn:aws:cloudfront:::distribution/"
            }
        }
    }
}
```

Also, if S3 is encrypted with KMS, the KMS key policy must be updated.  
```
{
    "Sid": "AllowCloudFrontServicePrincipalSSE-KMS",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam:::root",
        "Service": "cloudfront.amazonaws.com"
    },
    "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey*"
    ],
    "Resource": "*",
    "Condition": {
            "StringEquals": {
                "AWS:SourceArn": "arn:aws:cloudfront:::distribution/"
            }
        }
}
```

CloudFront Distribution S3 AccessDenied

Relevant content