Is it possible to deploy from GitHub to S3 private bucket with public access disabled?

Question

Hello,

I have spent almost a day in finding the solution to make it work, but all the threads in internet related this topic have only S3 public configuration with completely opened (or partitialy opened) public access to S3. But in our case we are going to store there some private files and we want to keep it secure. 
But from another side we use this s3 bucket for our Next.js app and cloudfront permissions to read from there. S3 bucket policy looks like this:

```
{
    "Version": "2008-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Sid": "AllowCloudFrontServicePrincipal",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudfront.amazonaws.com"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::some-bucket.here/*",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceArn": "arn:aws:cloudfront::{AWS_ACCOUNT}:distribution/{CLOUDFONT_ID}
                }
            }
        },
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::some-bucket.here/*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": [
                        "aws:SourceArn\": \"arn:aws:iam::{AWS_ACCOUNT}:role/github",
                        "arn:aws:iam::{AWS_ACCOUNT}:oidc-provider/token.actions.githubusercontent.com"
                    ]
                }
            }
        }
    ]
}
```
Bucket object ownership: ACL enabled

Cloudfront works fine, but github via granted full permissions to OIDC provider role can not deploy to private S3 bucket and i get all the time an error:
`An error occurred (AccessDenied) when calling the PutObject operation: Access Denied` but it works fine if to remove the checkmarks from acl in "bucket public access" (new, any list ACL`s).

And even if to run the next command locally (with AWS account configured with AWS admin permissions) i can not see the bucket objects when it is publickly blocked:
```aws s3 ls s3://some-bucket.here/ --no-sign-request```
and get the following error:
```An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied```

Please help to find the workaround or at least advise if it is possible in general (such kind of deployment). Thanks.

Accepted Answer

Firstly I’d never use this in a policy unless you really mean it  "Principal": "*",

You should remove the condition from the statement and place the role arn of the what the oidc uses in the principal section overwriting the asterisk.

In your GitHub actions you define your role to assume etc role-to-assume: arn:aws:iam::1234567890:role/example-role

eg

```
- name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v3
        with:
          role-to-assume: arn:aws:iam::1234567890:role/example-role
          role-session-name: samplerolesession
          aws-region: ${{ env.AWS_REGION }}
      # Upload a file to AWS s3
      - name:  Copy index.html to s3
        run: |
          aws s3 cp ./index.html s3://${{ env.BUCKET_NAME }}/
```

Use this role in the Principal on the bucket policy and remove the conditions.

Also can you confirm what your encryption settings are on the bucket.

eg.. Notice I have the bucket and bucket objects also defined on the resource

```
{
    "Version": "2008-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Sid": "AllowCloudFrontServicePrincipal",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudfront.amazonaws.com"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::some-bucket.here/*",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceArn": "arn:aws:cloudfront::{AWS_ACCOUNT}:distribution/{CLOUDFONT_ID}
                }
            }
        },
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                    "AWS": ["arn:aws:iam::{AWS_ACCOUNT}:role/example-role"]
              },
            "Action": "s3:*",
            "Resource": ["arn:aws:s3:::some-bucket.here/*",
              "arn:aws:s3:::some-bucket.here"],
        }
    ]
}
```

Is it possible to deploy from GitHub to S3 private bucket with public access disabled?

Relevant content