title: How to setup private files with S3, CloudFront and Carrierwave
body: <p>Currently I have an S3 Bucket with an access policy that only allows access from a CloudFront Origin Access Identity:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Id": "PolicyForCloudFrontPrivateContent",
      "Statement": [
          {
              "Sid": "Grant a CloudFront Origin Identity access to support private content",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity XXXXXXXXXX"
              },
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::my-bucket/*"
          }
      ]
  }
  </code></pre>
  
  <p>This should prevent any access to the S3 asset which is not through the CloudFront distribution. </p>
  
  <p>However when I input the S3 url into my web browser I can still access the file.</p>
  
  <p>I am using Carrierwave and Fog to upload files to S3 and have <code>config.fog_public = true</code> so I believe what is happening is that Fog is putting a public access setting on the uploaded object.</p>
  
  <p>I tried changing the setting to <code>config.fog_public = false</code> but that then started returning signed URL's that ignored my <code>asset_host</code> setting (so provided the signed S3 URL rather than the unsigned CloudFront URL).</p>
  
  <p>I presume I need to keep <code>config.fog_public = true</code> and have an S3 bucket policy that overrides the public access setting that Fog is putting on my objects.</p>
  
  <p>Can anyone advise if that is correct or is there a better approach?</p>