Restrict access to files in Amazon S3 buckets using Origin access identities (OAI)

• Create a special CloudFront user called an origin access identity (OAI) and associate it with your CloudFront distribution.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-overview.html

See also

• Amazon CloudFront: aws cloudfront, AWS::CloudFront, aws cloudfront list-cloud-front-origin-access-identities, aws cloudfront list-distributions, AWS::CloudFront::Distribution, AWS::CloudFront::Distribution Origin, aws cloudfront create-invalidation, aws cloudfront create-distribution
• AWS CloudFront, distributions, Invalidations, Amazon CloudFront Ready, aws cloudfront, CloudFront Functions, Lambda@Edge, Origin Shield, Signed URL, OAI, Origin Access Control (OAC), Amazon CloudFront edge locations, cloudfront.net