Adding OAI to CloudFront after the distribution is created

Question

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#private-content-creating-oai-console

If you didn’t create an OAI when you created your distribution...

I try to follow the instructions in the documentation but I can't find the OAI in S3 origin.   Is the documentation outdated?  I am trying to add OAI after the distribution has been created.

Answer

If you didn’t create an OAI when you created your distribution, you basically have two options:
* create a CloudFront OAI using the CloudFront console - [step by step instructions](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#private-content-creating-oai-console)
* use the CloudFront API. First you would need to create the [OAI](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#private-content-creating-oai-api) then [add](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#private-content-adding-oai-api) the OAI to your distribution

Answer

You can create OAI, and attach it to the origin in Update Origin Functionality.

**Note:** If you're using the s3 website endpoint as origin, OAI will not be available, you can use s3 rest API endpoint.

Adding OAI to CloudFront after the distribution is created

Relevant content