aws

Private S3 + CloudFront OAC for static sites

2026-07-20 · s3, cloudfront, terraform

The modern pattern for static hosting on AWS: keep the S3 bucket fully private (public access block on, KMS encryption, versioning) and let CloudFront reach it through Origin Access Control — the SigV4-based successor to Origin Access Identity.

Two policies make it work:

  1. A bucket policy allowing s3:GetObject to the cloudfront.amazonaws.com service principal, conditioned on AWS:SourceArn matching your distribution ARN.
  2. A KMS key policy statement letting CloudFront decrypt objects, since the bucket uses a customer-managed key.

This site’s infra/ directory implements exactly that with three reusable modules: kms, s3-bucket, and cloudfront.