Among us mod apk always imposter - S3 static site returning 403 Forbidden?

Question

Hi everyone, I'm pretty new to AWS and I'm hoping to get some help with what feels like a simple S3/CloudFront issue.

I'm working on a small, personal fan project – a simple, one-page static website. It's a guide for a popular community mod to help players. The whole project is just an `index.html`, a `style.css` file, and one image.

I'm following the standard practice of hosting it on S3 with a CloudFront distribution in front. However, while the domain loads, I'm getting a 403 Forbidden error and none of the content appears.

To make it easier for you to see the problem live, here is the public link to the guide I am building. I wanted to create something helpful and well-designed for the community.

**Project Link (where the 403 error is visible):**
https://modhello.com/among-us/

---

**Here's my setup:**

1.  **S3 Bucket:**
    *   Bucket is set to private (Block all public access is ON).
    *   Static website hosting is enabled on the bucket, pointing to `index.html`.
2.  **CloudFront Distribution:**
    *   I have created an Origin Access Identity (OAI) and updated the bucket policy to grant it `s3:GetObject` access.
    *   The origin points to the S3 bucket.
3.  **The Problem:** When I visit the CloudFront URL, I get the 403 error XML page from S3 instead of my `index.html`.

This is the bucket policy that CloudFront generated for me. I feel like I'm missing something obvious.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCloudFrontServicePrincipal",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudfront.amazonaws.com"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-awesome-guide-bucket/*",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceArn": "arn:aws:cloudfront::YOUR_ACCOUNT_ID:distribution/YOUR_DISTRIBUTION_ID"
                }
            }
        }
    ]
}
My goal is to have a simple resource for anyone searching for information on the among us mod apk always imposter features, so getting this basic hosting right is the first step.
Could someone please point out what common mistake I might be making? Is my bucket policy wrong? Or is there a setting in CloudFront I've overlooked?
Thanks in advance for any pointers!

re:Post Agent · Answer

Based on your setup description, there are a few potential causes for the 403 Forbidden error you're experiencing:

1. **Static Website Hosting with OAI/OAC Conflict**: You mentioned that you have static website hosting enabled on your S3 bucket while also using an Origin Access Identity (OAI). This is a common issue - when using OAI or Origin Access Control (OAC), you should not have static website hosting enabled on the bucket. These two features don't work together properly.

2. **Origin Configuration**: Your CloudFront distribution might be pointing to the S3 website endpoint instead of the S3 REST API endpoint. When using OAI/OAC, your origin should be the S3 bucket REST endpoint (e.g., `my-awesome-guide-bucket.s3.amazonaws.com`), not the website endpoint (e.g., `my-awesome-guide-bucket.s3-website-region.amazonaws.com`).

3. **Default Root Object**: Make sure you've set `index.html` as the default root object in your CloudFront distribution settings.

4. **Permissions Issue**: The bucket policy looks correct, but ensure that the CloudFront distribution ID and account ID in the condition are accurate.

To fix this issue:

1. Disable static website hosting on your S3 bucket if you want to use OAI/OAC (recommended for security).

2. Ensure your CloudFront origin is set to the S3 bucket REST API endpoint.

3. Verify that your CloudFront distribution has `index.html` set as the default root object.

4. If you need directory browsing behavior (like having `/among-us/` automatically serve the index.html in that folder), you'll need to add a CloudFront Function to append index.html to directory paths.

If you absolutely need to use S3 website hosting features (like default index documents for subdirectories), you would need to make your bucket publicly accessible and use the website endpoint as a custom origin, but this is less secure than using OAI/OAC with a private bucket.  
**Sources**  
[Access Denied for CloudFront to S3 static site | AWS re:Post](https://repost.aws/questions/QUOeSIXhphQsaJ1f_IJKGnog/access-denied-for-cloudfront-to-s3-static-site)  
[S3/Cloudfront & OAC: Access denied when accessing path other than index site | AWS re:Post](https://repost.aws/questions/QUfV8SeCqESR-XRLKWm_I3Qg/s3-cloudfront-oac-access-denied-when-accessing-path-other-than-index-site)  
[HTTP 403 status code (Permission Denied) - Amazon CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/http-403-permission-denied.html)

Among us mod apk always imposter - S3 static site returning 403 Forbidden?

Add your answer

Relevant content