title: S3 via CloudFront always gives me AccessDenied message
body: <p>As much as it's easy to set up Amazon Cloudfront for custom origins, it is giving me a hard time in setting it up for S3 origins.</p>
  
  <p>Regardless how I change my settings, when trying to access S3 object via CloudFront, it gives me AccessDenied message.</p>
  
  <p>I'm using CloudFront for a full site delivery. So the URL I intend to use and the one I'm getting AWS AccessDenied message on is:</p>
  
  <p><a href="http://www.mydomainname.com/imagefile/live/media/medium/06904976c744edf870db308a08320284.JPG" rel="nofollow noreferrer">http://www.mydomainname.com/imagefile/live/media/medium/06904976c744edf870db308a08320284.JPG</a></p>
  
  <p>The direct S3 URL for the object is below and it works fine:
  <a href="https://s3-eu-west-1.amazonaws.com/my-s3-bucket-name/live/media/medium/06904976c744edf870db308a08320284.JPG" rel="nofollow noreferrer">https://s3-eu-west-1.amazonaws.com/my-s3-bucket-name/live/media/medium/06904976c744edf870db308a08320284.JPG</a></p>
  
  <p><strong>Cloudfront Origin Settings:</strong></p>
  
  <p><img src="https://i.stack.imgur.com/yxo6r.jpg" alt="Cloudfront Origin Settings:"></p>
  
  <p><strong>Cloufront Behaviour Settings:</strong>
  <img src="https://i.stack.imgur.com/fjm2R.jpg" alt="Cloufront Behaviour Settings:"></p>
  
  <p>S3 Policy (of course instead of "my-s3-bucket-name" there is a real bucket name used).</p>
  
  <pre><code>{
      "Version": "2008-10-17",
      "Statement": [
          {
              "Sid": "PublicReadGetObject",
              "Effect": "Deny",
              "Principal": {
                  "AWS": "*"
              },
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::my-s3-bucket-name/live/bk/*"
          },
          {
              "Sid":" Grant a CloudFront Origin Identity access to support private content",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "*"
              },
              "Action": [
                  "s3:GetObject"
              ],
              "Resource": [
                  "arn:aws:s3:::my-s3-bucket-name/live/media/medium/*",
                  "arn:aws:s3:::my-s3-bucket-name/live/media/thumb/*",
                  "arn:aws:s3:::my-s3-bucket-name/live/media/thumb_v2/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>The filename used in the URL itself has "Everyone" as a grantee with open/download permissions.</p>
  
  <p>Can somebody spot where the issue is?</p>