title: Amazon S3 access from Cloudfront through HTTP
body: <ul>
  <li>I have a S3 bucket, serving as static website.</li>
  <li>I have a cloudfront distribution, pointed towards HTTP endpoint of the bucket.</li>
  <li>I want to limit access to my S3 bucket to only Cloudfront. </li>
  </ul>
  
  <p>I guess I can do this by adding Principal: arn:iam:cloudfront .... </p>
  
  <p>But this allows direct S3 access, not HTTP Endpoint access.</p>
  
  <p>When I configure Cloudfront to serve S3 bucket directly, it doesn't show subdirectory index.htmls. In order to reach mysite.com/blog/, I have to type mysite.com/blog/index.html</p>
  
  <p>For this reason, I have to use HTTP endpoint of the S3 as if the site is not on S3 but on an Apache server.</p>
  
  <p>Now I can't restrict access via arn:iam:cloudfront. Because Cloudfront becomes yet another web crawler, S3 becomes yet another web server.</p>
  
  <p>They suggest adding custom headers so that the server understands it's the cloudfront. But S3 doesn't support custom headers.</p>
  
  <p>Restricting user agent to CloudFront and Principal to AWS: * does a brief work but it doesn't stop UserAgent spoofing.</p>
  
  <p>How can I solve this problem?</p>