AWS

CloudFrontとS3

• S3は基本ACL無効でpublic Accessをブロックする設定にする
• CloudFrontのOAC(origin Access Controle)でS3のパケットポリシーでアクセス許可の設定を行う

//特定のCloudFront OACへの読み取り専用アクセスを許可するS3パケットポリシー
{
"Version": "2012-10-17",
"Id": "PutObjPolicy",
"Statement": [{
  "Sid": "DenyObjectsThatAreNotSSEKMS",
  "Principal": "*",
  "Effect": "Deny",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",
  "Condition": {
    "Null": {
      "s3:x-amz-server-side-encryption-aws-kms-key-id": "true"
    }
  }
}]
}