title: Creating an S3 bucket policy that allows access to Cloudfront but restricts access to anyone else
body: <p>I have the following policy:    </p>
  
  <pre><code>{
          "Version": "2008-10-17",
          "Id": "PolicyForCloudFrontPrivateContent",
          "Statement": [
              {
                  "Sid": "Stmt1395852960432",
                  "Action": "s3:*",
                  "Effect": "Deny",
                  "Resource": "arn:aws:s3:::my-bucket/*",
                  "Principal": {
                      "AWS": [
                          "*"
                      ]
                  }
              },
              {
                  "Sid": "1",
                  "Effect": "Allow",
                  "Principal": {
                      "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1IYJC432545JN"
                  },
                  "Action": "s3:GetObject",
                  "Resource": "arn:aws:s3:::my-bucket/*"
              }
          ]
      }
  </code></pre>
  
  <p>However, this is denying requests from all requestors, even Cloudfront. What is the correct way to do this?</p>
  
  <p>The problem is that objects are created by the client with public read. I currently do not have immediate control of the client to change this setting. So what I want is to have a policy that overrides individual object ACL. So <em>default deny</em> here does not work.</p>