How To Restrict S3 Bucket Access To CloudFront (3 Min) | AWS

In this tutorial, you'll learn how to restrict AWS S3 Bucket Access to a CloudFront Distribution using Access Control, Bucket Policy, Origin, Patterns & Behavior settings.
—
Facebook:   / gokcedbsql  
—
Video Transcript
—
Hi guys, this is Abhi from Gokcedb. In this video, you're going to learn how to restrict S3 bucket access to a CloudFront distribution in AWS. Let's start by navigating to the S3 service.

Here, I'll be using two buckets, bucket 1 and bucket 2. In Bucket one, I have a JPG file and a text file, and in bucket 2, I have a PNG file and a test file. Let's navigate to the CloudFront service then hit create a distribution.

For the origin domain, I'm going to select my bucket 1 and then click on Origin access control settings. Hit the create control setting button then choose sign request then hit create. I'm going to leave most of the other settings to default then hit the create distribution button.

Next, click on copy policy then navigate back to the permissions tab of bucket 1. Scroll down to the bucket policy section then hit edit and paste. Click on Save changes then go back to the CloudFront window.

Copy the distribution name and paste it into a browser. Add the name of the JPG at the end of the URL then hit enter. Give it a few minutes then hit refresh and you should see your image.

You should be able to access your text file in bucket 1. Let's go back to the cloud front window and navigate to the origins tab. Hit create and this time choose bucket 2 for the origin domain select origin access control settings then create a controlled setting for bucket 2.

I'm going to leave everything else to default then hit create origin. Just like before, click on copy policy and add it to the bucket policy of bucket 2. Next, click on the behaviors tab then hit create Behavior.

For path pattern, I'm going to select star.png and for origin, I'm going to select bucket 2. Let's leave everything else to default then click on create Behavior. Any request for PNG files should now be routed to bucket 2.

Let's test this Behavior by requesting the horse.png file. Looks like our configuration is working as expected. Now watch what happens when I try to request a text2.txt file I get an access denied error.

This is because all requests for txt files are being routed to bucket 1. If I try to request a test.file instead which does exist in bucket 1. The request should go through.

There you have it. Make sure you like, subscribe, and turn on the notification bell. Until next time.