To secure the S3 bucket and allow access only from CloudFront, the following steps should be taken:
Create an OAI in CloudFront:
In the CloudFront console, create an origin access identity (OAI) and associate it with your CloudFront distribution.
[Reference: Restricting Access to S3 Buckets, Update S3 Bucket Policy:, Modify the S3 bucket policy to allow access only from the OAI. This involves adding a policy statement that grants the OAI permission to get objects from the bucket and removing any other public access permissions., Example Policy:, json, Copy code, {, "Version": "2012-10-17",, "Statement": [, {, "Effect": "Allow",, "Principal": {, "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E3EXAMPLE", },, "Action": "s3:GetObject",, "Resource": "arn:aws:s3:::example-bucket/*", }, ], }, Reference: Bucket Policy Examples, Test Configuration:, Ensure that the S3 bucket is not publicly accessible and that requests to the bucket through the CloudFront distribution are successful., Reference: Testing CloudFront OAI, , , ]