How to Resolve AWS OAC Policy & CloudFront AccessDenied Errors

Select Language:

If you’re having trouble accessing your S3 bucket through CloudFront with Origin Access Control (OAC), you’re not alone. The good news is that most of these issues boil down to specific misconfigurations, and once you identify the problem, fixing it can be straightforward. Here’s a simple step-by-step guide to help you get your setup working smoothly.

First, check your S3 origin settings. Make sure you’re connecting to the REST endpoint of your bucket, not the website endpoint. For example, your origin should be something like my-bucket.s3.amazonaws.com, not my-bucket.s3-website.amazonaws.com. Using the website endpoint will prevent OAC from working and cause access errors.

Next, review your bucket policy. It must be precisely tailored to allow CloudFront access. The policy should grant permission only when the request comes from the CloudFront service principal (cloudfront.amazonaws.com) and when the SourceArn matches your distribution’s ARN. Including the SourceAccount adds extra security. Here’s a simple version of the policy you should use, just update your bucket name, account ID, and distribution ID accordingly:

json
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Sid”: “AllowCloudFrontOAC”,
“Effect”: “Allow”,
“Principal”: {
“Service”: “cloudfront.amazonaws.com”
},
“Action”: “s3:GetObject”,
“Resource”: “arn:aws:s3:::your-bucket-name/*”,
“Condition”: {
“StringEquals”: {
“AWS:SourceArn”: “arn:aws:cloudfront::your-account-id:distribution/your-distribution-id”
}
}
}
]
}

Ensure your CloudFront distribution is using OAC (not the older Origin Access Identity). To verify, go into your CloudFront console, select your distribution, view the ‘Origins’ tab, and confirm the ‘Origin Access Control’ setting says “Enabled” with your OAC ID.

Also, double-check your S3 Block Public Access settings. For added security, all public access should ideally be blocked, and the Object Ownership should be set to “Bucket owner enforced.” Make sure no public ACLs are left on your objects, especially if they were uploaded via the console or other tools.

After making these changes, be aware that your CDN might have cached old responses. Run a new invalidation to clear the cache, then test requests with a fresh browser or curl command. Use the response headers to see if CloudFront is serving cached results or trying to fetch from the origin. Checking the S3 server logs or enabling CloudTrail can confirm whether S3 is actually receiving your requests.

In summary, review your origin domain, confirm the OAC is properly attached, update your bucket policy accordingly, and clear any cached content. Testing with fresh requests and logs will help you pinpoint where the issue is. Once this setup is correct, consider documenting your process. Templetizing your configuration and automating checks will save you time and prevent future issues.

If you’re still stuck, sharing your CloudFormation or CDK code for the relevant parts can help review and optimize your configuration. This approach is especially useful if you plan to deploy multi-region static sites or want a secure, reliable setup for production.