Delete Bucket policy from the S3 bucket and enable block public access.


OAC-VN-S3.
Create successfully!!!

Giving CloudFront permission to access the S3 bucket.

{
"Version": "2008-10-17",
"Id": "PolicyForCloudFrontPrivateContent",
"Statement": [
{
"Sid": "AllowCloudFrontServicePrincipal",
"Effect": "Allow",
"Principal": {
"Service": "cloudfront.amazonaws.com"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::ws1-cloudfront/*",
"Condition": {
"StringEquals": {
"AWS:SourceArn": "arn:aws:cloudfront::905418478295:distribution/E2YGKQ4RKCO9LA"
}
}
}
]
}

Now if we access page from the S3 Object URL, we still cannot access because we only allow access from CloudFront.
https://ws1-cloudfront.s3.amazonaws.com/test.html

We can access test.html from CloudFront.
https://d2s62os8tlfgfh.cloudfront.net/test.html
