AWS AmazonS3 documentation change
Summary
Added CloudFront distribution access guidance and additional resource links for 403 errors
Security assessment
Expanded troubleshooting documentation for secure CloudFront-S3 integration. While security-related, this provides general guidance rather than addressing a specific vulnerability.
Diff
diff --git a/AmazonS3/latest/userguide/troubleshoot-403-errors.md b/AmazonS3/latest/userguide/troubleshoot-403-errors.md index c23714b6f..25b8f8057 100644 --- a//AmazonS3/latest/userguide/troubleshoot-403-errors.md +++ b//AmazonS3/latest/userguide/troubleshoot-403-errors.md @@ -5 +5 @@ -Access denied message examples and how to troubleshoot themBucket policies and IAM policiesAmazon S3 ACL settingsS3 Block Public Access settingsAmazon S3 encryption settingsS3 Object Lock settingsVPC endpoint policiesAWS Organizations policiesAccess point settings +Access denied message examples and how to troubleshoot themBucket policies and IAM policiesAmazon S3 ACL settingsS3 Block Public Access settingsAmazon S3 encryption settingsS3 Object Lock settingsVPC endpoint policiesAWS Organizations policiesCloudFront distribution accessAccess point settingsAdditional resources @@ -45,0 +46,2 @@ For access denied (HTTP `403 Forbidden`) errors, Amazon S3 doesn't charge the bu + * CloudFront distribution access + @@ -47,0 +50,2 @@ For access denied (HTTP `403 Forbidden`) errors, Amazon S3 doesn't charge the bu + * Additional resources + @@ -614,0 +619,25 @@ Additionally, if you incorrectly configured your bucket policy for a member acco +## CloudFront distribution access + +If you receive a Access Denied (403 Forbidden) error when trying to access your S3 static website through CloudFront, check these common issues: + + * **Do you have the correct origin domain name format?** + + * Make sure you're using the S3 website endpoint format (bucket-name.s3-website-region.amazonaws.com) rather than the REST API endpoint + + * Verify that static website hosting is enabled on your bucket + + * **Does your bucket policy allow CloudFront access?** + + * Ensure your bucket policy includes permissions for your CloudFront distribution's Origin Access Identity (OAI) or Origin Access Control (OAC) + + * Verify the policy includes the required s3:GetObject permissions + + + + +For additional troubleshooting steps and configurations, including error page setups and protocol settings, see [Why do I get a "403 access denied" error when I use an Amazon S3 website endpoint as the origin of my CloudFront distribution?](https://repost.aws/knowledge-center/s3-website-cloudfront-error-403) in the AWS re:Post Knowledge Center. + +###### Note + +This error is different from 403 errors you might receive when accessing S3 directly. For CloudFront-specific issues, make sure to check both your CloudFront distribution settings and S3 configurations. + @@ -642,0 +672,21 @@ If the Access Denied (403 Forbidden) error still persists after checking all the +## Additional resources + +For more guidance on Access Denied (403 Forbidden) errors you can check the following resources: + + * [How do I troubleshoot 403 Access Denied errors from Amazon S3?](https://repost.aws/knowledge-center/s3-troubleshoot-403) in the AWS re:Post Knowledge Center. + + * [Why do I get a 403 Forbidden error when I try to access an Amazon S3 bucket or object?](https://repost.aws/knowledge-center/s3-403-forbidden-error) in the AWS re:Post Knowledge Center. + + * [Why do I get an Access Denied error when I try to access an Amazon S3 resource in the same AWS account?](https://repost.aws/knowledge-center/s3-troubleshoot-403-resource-same-account) in the AWS re:Post Knowledge Center. + + * [Why do I get an Access Denied error when I try to access an Amazon S3 bucket with public read access?](https://repost.aws/knowledge-center/s3-troubleshoot-403-public-read) in the AWS re:Post Knowledge Center. + + * [Why do I get a "signature mismatch" error when I try to use a presigned URL to upload an object to Amazon S3?](https://repost.aws/knowledge-center/s3-presigned-url-signature-mismatch) in the AWS re:Post Knowledge Center. + + * [Why do I get an Access Denied error for ListObjectsV2 when I run the sync command on my Amazon S3 bucket?](https://repost.aws/knowledge-center/s3-access-denied-listobjects-sync) in the AWS re:Post Knowledge Center. + + * [Why do I get a "403 access denied" error when I use an Amazon S3 website endpoint as the origin of my CloudFront distribution?](https://repost.aws/knowledge-center/s3-website-cloudfront-error-403) in the AWS re:Post Knowledge Center. + + + +