Cloudfront S3 bucket file list by http request

Question

I'm plan place files with long random names into S3, then get access over Cloudfront website. Is this securely: no way for getting file list using http request and leakage file names (there enough to have file name for reading file content)?
I think there enough set Bucket policy only "Action": "s3:GetObject" for avoid bucket list outside?

Answer

If the bucket policy only allows the CloudFront identity to GetObject, then a ListObjects will be denied. But this approach is really relying on [Security through obscurity](https://en.wikipedia.org/wiki/Security_through_obscurity) which is not considered secure by most standards bodies.

```
"System security should not depend on the secrecy of the implementation or its components."
```

Cloudfront S3 bucket file list by http request

Conteúdo relevante