Restrict access to AWS S3 hosted static website

Hello.

If you have configured OAC correctly, you should be able to access the S3 website only via CloudFront.
Also, if you want to limit access to only your own domain, you can do so by linking AWS WAF to CloudFront.
By configuring this setting, it is possible to block users who access "cloudfront.net".
https://skildops.com/blog/denying-connections-originating-from-default-aws-domain-using-waf

Hello,

To restrict access to your website through your domain endpoint only follow these:

1.Enable Origin Access Control (OAC) on your CloudFront distribution:

• Go to the CloudFront distribution in the AWS Management Console.
• Under the "Origins" section, select the origin (your S3 bucket) and click "Edit".
• Ensure that the "Origin Domain Name" is set to the S3 bucket name (e.g., your-bucket-name.s3.amazonaws.com), not the static website endpoint.
• Scroll down to the "Origin Access Control" section and enable it.
• In the "Origin Access Identity" field, create a new Origin Access Identity (OAI) or select an existing one.
• Save the changes.

2.Update the S3 bucket policy to allow access only from the OAI:

• Go to the S3 bucket in the AWS Management Console.
• Navigate to the "Permissions" tab and click on "Bucket Policy".
• Replace the existing policy with the following (replace YOUR_BUCKET_NAME and YOUR_OAI_ID with your actual values):

{
    "Version": "2012-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity YOUR_OAI_ID"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
        }
    ]
}

• Save the policy.

3.Remove public access to the S3 bucket (if it was previously enabled):

• In the S3 bucket, go to the "Permissions" tab.
• Under "Bucket Policy", edit the policy and add a statement to deny public access (if needed):

{
    "Version": "2012-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity YOUR_OAI_ID"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
        }
    ]
}

• Save the policy.

you should be able to restrict access to your S3 bucket through CloudFront and your domain endpoint only, while preventing direct access to the S3 bucket endpoint.

Hi,

You have to go with 2 steps:

1. To restrict access to S3 bucket only by Cloudfront, just follow this guidance: https://repost.aws/knowledge-center/cloudfront-access-to-amazon-s3

2. To block use of CloudFront DNS name, I think you could achieve that using Lambda@Edge: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-at-the-edge.html

Specifically you could create a function for viewer-request. The function would inspect the request and then decide if to allow or deny it.

On https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-examples.html, have a look at Example: A/B testing, it is quite close to what you want to achieve.

Best,

Didier