CloudFront returning 403 instead of 404 for missing pages from S3 using OAC – Amazon web services

Michael's answer is exactly correct. I'm leaving a separate answer here just to flesh out the details of exactly what needs to be done. I'll use CloudFormation for illustration.

Here's an example of updating the S3 bucket policy to include s3:GetObject:

  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref Bucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
            Action: s3:ListBucket
            Resource: !Sub "${Bucket.Arn}"
            Condition:
              StringEquals:
                AWS:SourceArn: !Sub "arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"
          - Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
            Action: s3:GetObject
            Resource: !Sub "${Bucket.Arn}/*"
            Condition:
              StringEquals:
                AWS:SourceArn: !Sub "arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"

As Michael mentioned, you need to set DefaultRootObject to something or CloudFront will return a directory listing when / is requested. But you still need to indicate a default page if any sub-path root is indicated, such as /foo/bar/. And what if you don't want to indicate a default page? You can address both issues using CloudFront functions.

First set up a parameter for the default page:

Parameters:
  DefaultPage:
    Description: The default page, such as `index.html`.
    Type: String
    Default: index.html

Then set up the function:

  DefaultPageFunction:
    Type: AWS::CloudFront::Function
    Properties:
      Name: default-page
      AutoPublish: true
      FunctionConfig:
        Comment: Convert root requests to default page.
        Runtime: cloudfront-js-1.0
      FunctionCode: !Sub |
        function handler(event) {
          var request = event.request;
          var uri = request.uri;
          if (uri.endsWith("/")) {
            var defaultPage = "${DefaultPage}";
            if(defaultPage) {
              request.uri += defaultPage;
            } else {
              return {
                statusCode: 403,
                statusDescription: "Forbidden"
              };
            }
          }
          return request;
        }

This function handles both cases based upon the DefaultPage parameter. If it's set to a non-empty string, it will add that to any …/ path. If DefaultPage is empty, then it will return an HTTP 403 Forbidden for every …/ path.

Finally add it to your AWS::CloudFront::Distribution DefaultCacheBehavior:

          …
          FunctionAssociations:
            - EventType: viewer-request
              FunctionARN: !GetAtt DefaultPageFunction.FunctionMetadata.FunctionARN
        DefaultRootObject: !Ref DefaultPage

I threw in the DefaultRootObject for good measure, even though the function should take care of that case as well.

Warning! There seems to be a bug with CloudFormation that will get the parameter "stuck" with one value, so double-check that CloudFormation deployed the correct value if you modify DefaultPage after deploying. See the ticket I just opened: CloudFormation deploy doesn't update !Sub contents with new parameter value. #989