Ravi Sir's Cards › AWS
Deny direct S3 access
This revision card explains Deny direct S3 access. If Principal * GetObject remains, users skip CloudFront. It describes keep Allow only for CloudFront; test curl to S3 REST URL expects AccessDenied. The how-to section notes compare CF URL 200 vs S3 URL 403 after policy. An example on the card is fatima Khan confirms news images 403 on raw S3 after OAC policy.
Read card text
What this card says
Why do we need it?
If Principal * GetObject remains, users skip CloudFront.
What is it?
Keep Allow only for CloudFront; test curl to S3 REST URL expects AccessDenied.
AccessDenied
How to do it
Compare CF URL 200 vs S3 URL 403 after policy.
Example
Fatima Khan confirms news images 403 on raw S3 after OAC policy.