Search code examples
amazon-web-servicesamazon-s3amazon-cloudfront

Files uploaded with CloudFront 403 error when access Root account via AWS Console

Uploading files through CloudFront to s3 bucket via a CloudFront Origin Access Identity runs successfully, however properties of the uploaded files are unable to be modified and some meta-data is unable to be accessed by the root user of my AWS account. I am able to get the files through the CloudFront endpoint, however I do not understand why I am not able to modify or access some fields of the uploaded files through my AWS root account via the AWS Management Console.

The default ACL in the s3 bucket is for the root user account as can be seen below:

AWS s3 ACL Tab

I added in a second policy to my bucket just to ensure that the root user has explicit access to the files. The full bucket policy can be seen below:

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity 00000000000000"
                ]
            },
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket/stuff/",
                "arn:aws:s3:::my-bucket/stuff/*",
                "arn:aws:s3:::my-bucket/other-stuff/",
                "arn:aws:s3:::my-bucket/other-stuff/*"
            ]
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::000000000000:root"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-bucket/stuff/",
                "arn:aws:s3:::my-bucket/stuff/*",
                "arn:aws:s3:::my-bucket/other-stuff/",
                "arn:aws:s3:::my-bucket/other-stuff/*"
            ]
        }
    ]
}

When I view a file that I have uploaded through CloudFront I am receiving a Access Denied for numerous options on the file overview tab:

AWS S3 Bucket File Overview Tab

I am also receiving more Access Denied from the file properties tab on the same file: AWS S3 Bucket File Properties Tab

Solution

  • You need to pass ACL "Bucket-owner-full-control" with the PUT/POST call you're making with CloudFront link and also modify the Bucket policy for CloudFront to allow you PutobjectACL.