Sharing S3 Bucket between Accounts for CloudFront - amazon-web-services

I have two AWS accounts. Each account has an S3 bucket and CloudFront which exposes the contents of the S3 bucket.
I would like to get rid of a CORS issue.
For that I I need to serve all content using one CloudFront.
How I can grant permissions to the S3 bucket from account2 to CloudFront in account1?

This is possible if the bucket is publicly accessible , the bucket won't come in the drop down when you're creating origin but you can use the name as bucket.s3.region.amazonaws.com.
It is also possible using origin access identity. Use first your own bucket to create the bucket policy automatically by CloudFront, you should be able to see IAM identity in CloudTrail, you can copy the same policy on the other account S3 bucket and OAI should work.

Related

is it possible to copy s3 bucket content from one bucket to another account s3 bucket without using bucket policy?

I want to copy the S3 bucket object to a different account, but the requirement can't use the Bucket policy,
then is it possible to copy content from one bucket to another without using the bucket policy?
You cannot use native S3 object replication between different accounts without using a bucket policy. As stated in the permissions documentation:
When the source and destination buckets aren't owned by the same accounts, the owner of the destination bucket must also add a bucket policy to grant the owner of the source bucket permissions to perform replication actions
You could write a custom application that uses IAM roles to replicate objects, but this will likely be quite involved as you'll need to track the state of the bucket and all of the objects written to it.
install AWS CLI,
run AWS configure set source bucket credentials as default and,
visit https://github.com/Shi191099/S3-Copy-old-data-without-Policy.git

User does not have access to target (s3) from Athena

I am trying to access an s3 bucket in different AWS account using Athena, but I'm getting the below error message :
User does not have access to target.
I have added all the necessary policies to the s3 bucket in the other AWS account.
When I add the s3 location as a datastore in my account, I am unable to crawl the bucket which is located in the other account.
Is there anything that I need to do from my side in terms on policy.

Allow CloudFront to access S3 origin while also having S3 bucket Block all public access?

I am trying to setup the S3 buckets I want my CloudFront distribution to access.
From my client I use AWS mobile SDK to upload to S3. When clients consume files from S3 I hit CloudFront and things worked until I made this change:
When I created the distribution, I had CloudFront update the bucket policy to have the OAI included in the principal:
So, then I thought I could run GET calls on CloudFront, because CloudFront has the OAI setup and S3 bucket reflects that.
However, I keep getting Access denied:
What else do I need to do to secure down the bucket and only allow CloudFront to read and allow my client app to be able to upload files to it using the SDK configured with the poolId I have setup for it?. Unless I leave the "Block all public access" unchecked, I get access denied via CloudFront.
Unfortunately according to the documentation the following is stated:
Amazon S3 Block Public Access must be disabled on the bucket.
This is because it will ignore the bucket policy due to the Block public and cross-account access to buckets and objects through any public bucket or access point policies value.
Unless your bucket policy also allows anonymous GetObject by default your objects will not be public.

Can a person see other files in the s3 bucket if the s3 bucket has given public access?

Can a person see other files in the s3 bucket if the s3 bucket has given public access?
Also he have a link to one of the files in the s3 bucket.
Objects in Amazon S3 are private by default. Nobody can view a listing of the bucket, nor the objects within the bucket, unless you have granted access in some way.
The typical mechanism for "making a bucket public" is to add a Bucket Policy that can grant permission to perform operations such as GetObject, PutObject and ListBucket. You should look at your Bucket Policy to determine what permissions have been granted.
If the Bucket Policy grants ListBucket permissions to anyone (Principal = *), then they would be able to view a list of all objects in the bucket. This is normally not recommended.

how to access cloudfront to s3 bucket object simple url

i am trying to access cloudfront to s3 bucket object response "AccessDenied".
xxxxxxxxxxxxx.cloudfront.net/bucket_name/35.jpg
inside bucket i can access url this is "public" url.
https://s3.ap-south-1.amazonaws.com/bucket_name/35.jpg
I am also try another bucket with another cloudfront ID with signed URL result is same. Please view code here =>
amazon cloudfront Error "AccessDenied"
You should:
Configure your CloudFront distribution with an Origin to point to your S3 bucket
Access the content via: xxxx.cloudfront.net/35.jpg
See:
Using Amazon S3 Origins and Custom Origins for Web Distributions
Using CloudFront with Amazon S3
Task List for Creating a Web Distribution