S3/Cloudfront & OAC: Access denied when accessing path other than index site

Hi People

I am hosting a static website on S3 and serving it via Cloudfront. After doing some changes I realised that other than the index path / , everything else returns 403 Access denied. so For instance www.domainname.com/it gives me access denied, www.domainname.com/ is good.

I recently made some changes in my website.. one of them must be the responsible of my issue as everything was working fine before.

The one I believe may be the reason is that I changed the S3 policy from public to private AND MOVED TO OAI TO OAC. I did this change reading it was more secure blocking public access and also migrating to AOC. Happy if you explain me how this thing works. .

Below I am pasting some of the resources but please feel free to ask me to check anything else, as the issue may not be this.. i pushed few commits following guides.

[PS: Replacing bucket name with BUCKET_NAME in case it is a sensitive data]

resource "aws_s3_bucket_public_access_block" 
...
block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
...
}


...

resource "aws_s3_bucket_acl" "BUCKET_NAME_acl" {
  depends_on = [
    aws_s3_bucket_ownership_controls.BUCKET_NAME,
    aws_s3_bucket_public_access_block.tBUCKET_NAME_public_access_block,
  ]
  bucket = aws_s3_bucket.BUCKET_NAME_bucket.id
  acl    = "private"

STILL NOT SOLVED BUT SOME EXTRA INFO:



 if I do `domain.com/` the index.html is correctly rendered, or if I do domain.com/robot.txt, it is correctly returned.

But if I do domain.com/it (which in s3 is a folder containing index.html) gives me 403.

BUT if I write the full file path.. like domain.com/it/index.html it then works.. so looks like cloudfront is not solving correctly the sub paths?



...
resource "aws_s3_bucket_ownership_controls" "BUCKET_NAME_bucket" {
  bucket = aws_s3_bucket.BUCKET_NAME_bucket.id

  rule {
    object_ownership = "BucketOwnerPreferred"
  }
}

...

...

resource "aws_cloudfront_origin_access_control" "current" {
  name                              = "OAC ${aws_s3_bucket.BUCKET_NAME_bucket.bucket}"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}


...

data "aws_caller_identity" "current" {}
resource "aws_s3_bucket_policy" "BUCKET_NAME_bucket_policy" {
    bucket = aws_s3_bucket.BUCKET_NAME_bucket.id

    policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Sid       = "AllowCloudFrontAccess"
          Effect    = "Allow"
          Principal = {
            Service = "cloudfront.amazonaws.com"
          }
          Action    = "s3:GetObject"
          Resource  = "${aws_s3_bucket.BUCKET_NAME_bucket.arn}/*"
          Condition = {
            StringEquals = {
              "AWS:SourceArn" = "arn:aws:cloudfront::${data.aws_caller_identity.current.account_id}:distribution/${aws_cloudfront_distribution.BUCKET_NAME_distribution.id}"
            }
          }
        },
      ]
    })

  }