title: Amazon S3 static Website accessible (403 Error) when secure transport policy added
body: <p>We have an Amazon S3 static website and it was working fine until we introduced a policy where we allow only secure data transfer by enforcing <code>aws:SecureTransport</code>. A policy with simply denies access to the site when the <code>aws:SecureTransport</code> fails. But when we access the site now, it says <code>403 Forbidden</code> error.</p>
  <p>The set up is that we have <em>CloudFront</em> fronted to this site, so the traffic routes through the CloudFront, not sure if this has to do something with the issue we are facing, where the traffic route between CloudFront and Amazon S3 is <em>http</em> only. Having said that, strangely when we tweek the policy to have <code>aws:SecureTransport:true</code> and allow such requests to the site, it works fine, but when we have deny policy <code>aws:SecureTransport:false</code>, then we end up getting <code>403 error</code>. Sharing both the policies here.</p>
  <p>When we have this the static website works fine:</p>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;AllowOriginAccessIdentity&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity XXXXXXXXXXX&quot;
              },
              &quot;Action&quot;: &quot;s3:GetObject&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::example.domain.com/*&quot;
          },
          {
              &quot;Sid&quot;: &quot;ForceSSLRequest&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;*&quot;
              },
              &quot;Action&quot;: &quot;s3:*&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::example.domain.com/*&quot;,
              &quot;Condition&quot;: {
                  &quot;Bool&quot;: {
                      &quot;aws:SecureTransport&quot;: true
                  }
              }
          }
      ]
  }
  </code></pre>
  <p>Where as when we have as below, it fails, and we want this to be implemented to be absolutely sure:</p>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;AllowOriginAccessIdentity&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity XXXXXXXXXXX&quot;
              },
              &quot;Action&quot;: &quot;s3:GetObject&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::example.domain.com/*&quot;
          },
          {
              &quot;Sid&quot;: &quot;ForceSSLRequest&quot;,
              &quot;Effect&quot;: &quot;Deny&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;*&quot;
              },
              &quot;Action&quot;: &quot;s3:*&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::example.domain.com/*&quot;,
              &quot;Condition&quot;: {
                  &quot;Bool&quot;: {
                      &quot;aws:SecureTransport&quot;: false
                  }
              }
          }
      ]
  }
  </code></pre>
  <p>Update: I have a policy as below allowing an OAI accessing the S3. This does not work, but when we read/understand the policy it makes sense to allow access the webiste, but it fails :(.</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;AllowOriginAccessIdentity&quot;,
              &quot;Effect&quot;: &quot;Deny&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity XXXXXXXXXXX&quot;
              },
              &quot;Action&quot;: &quot;s3:*&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::example-domain.com/*&quot;,
              &quot;Condition&quot;: {
                  &quot;Bool&quot;: {
                      &quot;aws:SecureTransport&quot;: &quot;false&quot;
                  }
              }
          }
      ]
  }
  </code></pre>
  <p>But the below works, even though logical readability is same according to my understanding.</p>
  <pre><code>{
          &quot;Version&quot;: &quot;2012-10-17&quot;,
          &quot;Statement&quot;: [
              {
                  &quot;Sid&quot;: &quot;AllowOriginAccessIdentity&quot;,
                  &quot;Effect&quot;: &quot;Allow&quot;,
                  &quot;Principal&quot;: {
                      &quot;AWS&quot;: &quot;arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity XXXXXXXXXXX&quot;
                  },
                  &quot;Action&quot;: &quot;s3:*&quot;,
                  &quot;Resource&quot;: &quot;arn:aws:s3:::example-domain.com/*&quot;,
                  &quot;Condition&quot;: {
                      &quot;Bool&quot;: {
                          &quot;aws:SecureTransport&quot;: &quot;true&quot;
                      }
                  }
              }
          ]
      }
  </code></pre>
  <p>Any help in understanding this behavior is much appreciated.</p>