What might cause an "Access Denied" error when creating a cloudfront s3 Origin using cloudformation?

Hi Gary, I promise you that the following does appear to work, but only if i add the origin through the console, not when using cloudformation. The problem is using cloudformation to do the same. Also, I cannot add the distribution ID at this point to the bucket policy as it is unknown, and this bucket is not part of this stack.

    {
        "Effect": "Allow",
        "Principal": {
            "Service": "cloudfront.amazonaws.com"
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::MyBucketName/*",
        "Condition": {
            "StringEquals": {
                "aws:ResourceOrgID": "myOrgId"
            }
        }
    },

It's really stumped me

Hey James,

So I stand true with my statement still. Your policy "Condition" isnt allowing allowing access from your ORG, its allowing access from CloudFront to your Bucket In your Org. The Condition ResourceOrgID is the resource being accessed not the source account/service.

aws:ResourceOrgID = AWS organization ID of the resource being accessed

This means anycloud Distribution can access your bucket. PrincipalOrgID would be the condition you would need to only allow access from a Role/Account in your Org but that as I said isnt supported.

The table here explains what your condition is https://aws.amazon.com/blogs/security/how-to-control-access-to-aws-resources-based-on-aws-account-ou-or-organization/

Your policy is only backing up your defined resource being that the bucket is in your org which is going to be because thats the where the bucket lives. So that condition doesnt actually do anything.

Anyway that wasnt the issue you had but one to review if security is a concern..

We use terraform where that issue you have with cat and mouse isnt a problem..

Gary

Hey there,

You can NOT reference an ResourceOrgID on Principals originating from AWS Services. The AWS Services i.e. Cloudfront does NOT reside in your ORG. You will need to reference the CloudFront ARN of the account its setup in than the ORG

Correct your bucket policy which should fix the issue as an example. Update the Bucket name and sourceARN :-

{
    "Version": "2012-10-17",
    "Statement": {
        "Sid": "AllowCloudFrontServicePrincipalReadOnly",
        "Effect": "Allow",
        "Principal": {
            "Service": "cloudfront.amazonaws.com"
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",
        "Condition": {
            "StringEquals": {
                "AWS:SourceArn": "arn:aws:cloudfront::111122223333:distribution/EDFDVBD6EXAMPLE"
            }
        }
    }
}

If you are using KMS encryption you may need to also adjust your KMS policy also.

If this answers your question, please accept this so it helps others and me.

I think I ran into a similar problem once and it was caused by not using the region as part of the DomainName when referencing an S3 bucket.