Question

A company serves a static website from an Amazon S3 bucket through an Amazon CloudFront distribution. The bucket has Block Public Access enabled. After migrating from a legacy Origin Access Identity (OAI) to Origin Access Control (OAC), users report that all requests to the site return HTTP 403 Access Denied. The CloudFront origin is correctly configured to use OAC. What is the MOST likely cause that a CloudOps engineer should investigate first?

Accepted Answer

The S3 bucket policy still grants access only to the old OAI principal and was not updated to allow the CloudFront service principal with the distribution's source ARN condition.

Answer

The CloudFront distribution is missing an SSL/TLS certificate from AWS Certificate Manager in the us-east-1 Region.

Answer

Block Public Access must be disabled on the S3 bucket for OAC to retrieve objects from the origin.

Answer

The CloudFront distribution's default root object is not set, causing S3 to reject the requests.