title: AWS CloudFront access denied to S3 bucket
body: <p>I am trying to setup <code>CloudFront</code> to serve static files hosted in my <code>S3</code> bucket. I have setup distribution but I get <code>AccessDenied</code> when trying to browse to the CSS (<code>/CSS/stlyle.css</code>) file inside S3 bucket:</p>
  <pre><code>&lt;Error&gt;
      &lt;Code&gt;AccessDenied&lt;/Code&gt;
      &lt;Message&gt;Access Denied&lt;/Message&gt;
      &lt;RequestId&gt;E193C9CDF4319589&lt;/RequestId&gt;
      &lt;HostId&gt;
  xbU85maj87/jukYihXnADjXoa4j2AMLFx7t08vtWZ9SRVmU1Ijq6ry2RDAh4G1IGPIeZG9IbFZg=
      &lt;/HostId&gt;
  &lt;/Error&gt;
  </code></pre>
  <p>I have set my CloudFront distribution to my S3 bucket and created new <code>Origin Access Identity policy</code> which was added automatically to the S3 bucket:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2008-10-17&quot;,
      &quot;Id&quot;: &quot;PolicyForCloudFrontPrivateContent&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;1&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E21XQ8NAGWMBQQ&quot;
              },
              &quot;Action&quot;: &quot;s3:GetObject&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::myhost.com.cdn/*&quot;
          }
      ]
  }
  </code></pre>
  <p>Did I miss something?</p>
  <p>I want all my files in this S3 bucket be served via CloudFront...</p>
  <p>*** UPDATE ***</p>
  <p>This cloud front <a href="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/GettingStarted.SimpleDistribution.html#GettingStartedUploadContent" rel="noreferrer">guide</a> says:</p>
  <p><em>By default, your Amazon S3 bucket and all of the objects in it are private—only the AWS account that created the bucket has permission to read or write the objects in it. If you want to allow anyone to access the objects in your Amazon S3 bucket using CloudFront URLs, you must grant public read permissions to the objects. (This is one of the most common mistakes when working with CloudFront and Amazon S3. You must explicitly grant privileges to each object in an Amazon S3 bucket.)</em></p>
  <p>So based on this I have added new permissions to all objects inside S3 bucket to <code>Everyone Read/Download</code>. Now I can access files.</p>
  <p>But now when I access the file like <code>https://d3u61axijg36on.cloudfront.net/css/style.css</code> this is being redirected to S3 URI and <code>HTTP</code>. How do I disable this?</p>