title: How to write an S3 bucket policy to *only* allow specific IAM role and Cloudfront Origin Access Identity?
body: <p>My overall objective:
  I tried several things and read relevant AWS documentation but am unable to figure how to write an S3 bucket policy to allow access only to specific IAM role and Cloudfront Origin Access Identity(OAI), and deny everyone else.</p>
  
  <p>What I've tried so far:
  1. I found this blog, which shows how to restrict s3 bucket access to specific IAM roles:<a href="https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/" rel="noreferrer">https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/</a>
  2. Based on the above blog, I wrote the following bucket policy. This policy allows only MY_IAM_ROLE to allow all operations on a bucket called 'myBucket':</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Deny",
              "Principal": "*",
              "Action": "s3:*",
              "Resource": [
                  "arn:aws:s3:::myBucket",
                  "arn:aws:s3:::myBucket/*"
              ],
              "Condition": {
                  "StringNotLike": {
                      "aws:userId": [
                          "MY_IAM_ROLE_USER_ID:*"
                      ]
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <ol start="3">
  <li>I'm not able to find an aws-wide key -- <a href="http://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html" rel="noreferrer">http://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html</a> -- for the OAI, which I could plug into the "aws:userId" array along with MY_IAM_ROLE_USER_ID. I tried plugging in the OAI's CanonicalUserId but it didn't work.</li>
  </ol>
  
  <p>My question:
  <strong>How can I combine (1) aws:userid of IAM roles/users and (2) OAI IDs in a single policy statement?</strong></p>