Granting Ready/Write Access to IAM or IAM Identity Center User to Sync to S3 Backed Cloudfront Distribution

Hello.

Since CloudFront is using the OAC security framework, I am a little uncertain how to do this. The refresh tokens associated with IAM Identity Center SSO seems problematic unless I automate the refresh of the tokens too.

If the authentication information is to be used for regular batches, etc., I think it is a good idea to use the access key and secret access key created from the IAM user.
https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_identity-management.html#AccessControlMethods

You might have specific use cases that require long-term credentials with IAM users in AWS. You can use IAM to create these IAM users in your AWS account, and use IAM to manage their permissions. Some of the use cases include the following:

• Workloads that can't use IAM roles
• Third-party AWS clients that require programmatic access through access keys
• Service-specific credentials for AWS CodeCommit or Amazon Keyspaces
• AWS IAM Identity Center is not available for your account and you have no other identity provider

As a best practice in scenarios in which you need IAM users with programmatic access and long-term credentials, we recommend that you update access keys when needed. For more information, see Updating access keys.

I can't find any relevant info on how I would extend the permissions of the bucket and whether the best place to do it is via OAC (which seems immutable) or the bucket itself, currently only allowing s3:GetObject action for the Cloudfront service.

You can restrict the ability of only specific IAM users to delete and upload objects using the bucket policy for your S3 bucket.
For example, if you set the following bucket policy, IAM user "userA" will be allowed "s3:PutObject" and "s3:DeleteObject".
Please allow "s3:PutObject" and "s3:DeleteObject" in the IAM policy of IAM user "userA".

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "sid1",
            "Effect": "Deny",
            "Principal": "*",
            "Action": [
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::example-bucket/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "aws:username": "userA"
                }
            }
        }
    ]
}

If you want to use it together with the bucket policy set with OAC, I think you should do the following.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCloudFrontServicePrincipalReadOnly",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudfront.amazonaws.com"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::example-bucket/*",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceArn": "arn:aws:cloudfront::111122223333:distribution/<CloudFront distribution ID>"
                }
            }
        },
        {
            "Sid": "sid1",
            "Effect": "Deny",
            "Principal": "*",
            "Action": [
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::example-bucket/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "aws:username": "userA"
                }
            }
        }
    ]
}

I got around to implementing this and am hitting an "implicit deny" error. My user is an IAM user and I am using access key with secret access key. Any idea why that might be happening?

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudfront.amazonaws.com"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::amazon-cloudfront-secure-static-site--s3bucketroot-xxxxxxxxxxxx/*",
            "Condition": {
                "StringEquals": {
                    "AWS:SourceArn": "arn:aws:cloudfront::xxxxxxxxxxxx:distribution/XXXXXXXXXXXXXX"
                }
            }
        },
        {
            "Sid": "DenyAllButMunkiUser",
            "Effect": "Deny",
            "Principal": "*",
            "Action": [
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::amazon-cloudfront-secure-static-site--s3bucketroot-XXXXXXXXXXXX/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:username": "myuser"
                }
            }
        }
    ]
}

Here is the inline policy for the user "myuser"

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Action": [
				"s3:ListBucket",
				"s3:GetObject",
				"s3:DeleteObject",
				"s3:PutObject"
			],
			"Effect": "Allow",
			"Resource": "arn:aws:s3:::amazon-cloudfront-secure-static-site--s3bucketroot-xxxxxxxxxxxx/*",
			"Condition": {
				"StringEquals": {
					"s3:prefix": [
						"",
						"folder1/",
						"folder2/"
					],
					"s3:delimiter": [
						"/"
					]
				}
			}
		}
	]
}