S3 Rest API Cloudfront error 403 using OAC

Question

I followed the guide below to resolve a CloudFront 403 error, but am having no luck.
[https://repost.aws/knowledge-center/s3-rest-api-cloudfront-error-403](s3-rest-api-cloudfront-error-403)

Here is a screenshot of the exact error message I am receiving when I use the CloudFront domain to access the website:
![Enter image description here](/media/postImages/original/IMgNt88YBFQb6aP9TS_OMnBw)

I checked the following settings following items that the guide suggested.

1) The origin domain name is 2023-05-12-at-website.s3.us-east-1.amazonaws.com

2) The s3 bucket is using Amazon S3 managed keys (SSE-S3) with AWS KMS encryption enabled
3) I am using **OAC** so Here is my S3 bucket policy giving CloudFront Access.  Amazon S3 Block Public Access is enabled.

```
{
    "Version": "2008-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Sid": "AllowCloudFrontServicePrincipal",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudfront.amazonaws.com"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::2023-05-12-at-website/*",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceArn": "arn:aws:cloudfront::(my-AWS-Account-Number):distribution/(my CloudFront Distribution)"
                }
            }
        }
    ]
}
```
4) The AWS account owns the object and the requested objects exist in the S3 bucket.  I also defined a default root object since the client will be requesting the root of my distribution to access the site.

5) I verified that I can access and download the s3 objects from the AWS CLI.

What am I missing here?

Accepted Answer

Check that you have configured the signing behavior correctly for your Origin Access Control ID. Per the documentation, this should be set to "Always."

If you have accidentally set it to "Never" this will effectively turn off OAC and require the bucket to be publicly accessible.

Answer

Something worth fixing that *might* solve it if you're lucky is changing your policy's Version field to "2012-10-17".

As per https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_version.html, "2008-10-17 - This was an earlier version of the policy language. You might see this version on older existing policies. Do not use this version for any new policies or when you update any existing policies. Newer features, such as policy variables, will not work with your policy."

Answer

If you're using KMS encryption, make sure that CloudFront has permission to use the key to decrypt the object(s).

You may need to add a statement to the KMS key policy - here is an example:

```
{
    "Sid": "AllowCloudFrontServicePrincipalSSE-KMS",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam:::root",
        "Service": "cloudfront.amazonaws.com"
    },
    "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey*"
    ],
    "Resource": "*",
    "Condition": {
            "StringEquals": {
                "AWS:SourceArn": "arn:aws:cloudfront:::distribution/"
            }
        }
}
```

Answer

That was the culprit!  
![security_origin_access_control_ID](/media/postImages/original/IMeKhUDXVGTTG23WqhHdMAAA)

After changing **Signing Behavior** from "*Do not sign requests*" to "*Sign requests*" I can now access the S3 website through the CloudFront distribution URL.

S3 Rest API Cloudfront error 403 using OAC

Relevant content