Allow CloudFront to serve encrypted content from S3

[ab77]

(Override all values in parentheses)

(Run yamllint folder/template.yaml, cfn-lint -i E1019 E3002 E2520 -t folder/template.yaml, and aws cloudformation validate-template --template-body file://folder/template.yaml before you open a PR)

(Do not include multiple changes in one PR. Open additional PRs instead.)

---

Allow CloudFront to service encrypted content from S3 origins. See, https://aws.amazon.com/blogs/networking-and-content-delivery/serving-sse-kms-encrypted-content-from-s3-using-cloudfront/

[michaelwittig]

Hi @ab77

The statement in the mentioned blog post looks different:

- Sid: Allow access through S3 for all principals in the account that are authorized to use S3
            Effect: Allow
            Principal: 
              AWS: "*"
            Action:
            - kms:Encrypt
            - kms:Decrypt
            - kms:ReEncrypt*
            - kms:GenerateDataKey*
            - kms:DescribeKey
            Resource: '*'
            Condition:
              StringEquals:
                kms:CallerAccount: !Ref 'AWS::AccountId'
                kms:ViaService: !Join ['.', ['s3', !Ref 'AWS::Region', 'amazonaws.com']]

Can you explain the differecne?

I also wonder why the blog post/this PR grants kms:Encrypt, kms:ReEncrypt*, kms:GenerateDataKey* that shouldn't be needed for reading a encrypted file.

[ab77]

Hello, we've tested this config in a pre-production environment, with CF being able to serve encrypted content. Logically, the only permissions required, since CF is only doing decryption here, is kms:Decrypt (kms:GenerateDataKey* seems to relate to encryption only). I'll retest tomorrow with reduced permissions and report back..

[ab77]

I'll retest tomorrow with reduced permissions and report back..

Tested, OK. The only permission required from CF perspective is kms:Decrypt. Encryption permissions are set on whatever IAM actor is performing S3 upload operations (in our case, an IAM user).

[michaelwittig]

Thanks @ab77