CloudFront config option to opt-out of updating origin bucket policy when passing OAI
See original GitHub issueIn the AWS console you can choose option for CloudFront to not update origin s3 bucket policy with read permissions.
The CDK Cloudfront tries to update bucket policy without giving an option to opt-out. Here is the related code. https://github.com/aws/aws-cdk/blob/b3abc681b97a385be83c6efd2fe3e6eb57933e77/packages/%40aws-cdk/aws-cloudfront/lib/web_distribution.ts#L702
if (originConfig.s3OriginSource) {
// first case for backwards compatibility
if (originConfig.s3OriginSource.originAccessIdentity) {
// grant CloudFront OriginAccessIdentity read access to S3 bucket
originConfig.s3OriginSource.s3BucketSource.grantRead(originConfig.s3OriginSource.originAccessIdentity);
s3OriginConfig = {
originAccessIdentity:
`origin-access-identity/cloudfront/${
originConfig.s3OriginSource.originAccessIdentity.originAccessIdentityName
}`
};
} else {
s3OriginConfig = {};
}
}
Use Case
We have a use case were we need manage the bucket policy specifically for our automation to work properly.
Proposed Solution
Is it possible to pass a flag on S3OriginConfig interface, something like -
const distibutionConfig: CloudFrontWebDistributionProps = {
webACLId,
originConfigs: [
{
s3OriginSource: {
s3BucketSource: bucket,
originAccessIdentity,
updateBucketPolicy: false // true by default
},
behaviors: [{ isDefaultBehavior: true }]
}
],
aliasConfiguration
};
.......
......
# web_distribution.ts
if (originConfig.s3OriginSource) {
// first case for backwards compatibility
if (originConfig.s3OriginSource.originAccessIdentity ) {
if(originConfig.s3OriginSource.updateBucketPolicy) {
// grant CloudFront OriginAccessIdentity read access to S3 bucket
originConfig.s3OriginSource.s3BucketSource.grantRead(originConfig.s3OriginSource.originAccessIdentity);
}
......
......
- 👋 I may be able to implement this feature request
- ⚠️ This feature might incur a breaking change
This is a 🚀 Feature Request
Issue Analytics
- State:
- Created 3 years ago
- Reactions:4
- Comments:14 (4 by maintainers)
Top Results From Across the Web
Restricting access to an Amazon S3 origin - Amazon CloudFront
After you update the S3 origin's bucket policy to allow access to both OAI and OAC, you can update the distribution configuration to...
Read more >Cloudfront Origin Access Identity (OAI): How to use it? - StormIT
If you choose Yes, update the bucket policy, CloudFront updates S3 bucket permissions to grant the specified OAI permission to read files in...
Read more >Origin Access Identity - Jayendra's Cloud Certification Blog
Origin Access Identity (OAI) can be used to prevent users from directly accessing objects from S3. S3 origin objects must be granted public...
Read more >Restrict access to an Amazon S3 bucket using CloudFront
Before setting up the restriction, make sure that the S3 origin of ... This step updates the bucket policy of the S3 origin...
Read more >Cloudfront with S3 origin returns AccessDenied when using ...
No issues with CF distro, bucket policy nor OAI were identified. ... AWS::CloudFront::Distribution Properties: DistributionConfig: Origins: ...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
@maoosi - A flag, as originally described, could work. I would be willing to accept PRs to that effect.
The other approach I see would be to alter the input into the
(CloudFrontWeb)Distribution
to prevent the policy from changing. Something like this:It does in CDK version 2.9.0 in Python.
Alternatively, you can override the Bucket PolicyDocument, with the
add_property_override
method of the isolated CfnResourceFor example, I wanted my OAI to access only 2 specific folders of my S3Origin :