← Back to FAQ overview
1) Do I need CloudFront to serve an S3 static site over HTTPS?
Yes if you want a custom domain with HTTPS. S3 static website endpoints do not support custom TLS certificates; CloudFront terminates HTTPS in front of S3 and gives you control over headers, caching, and WAF rules.
2) Which bucket policy should I use?
For public static content, grant only GetObject on the objects path. Scope it to the exact bucket and prefix instead of using a wildcard `*` action. Example policy targets `arn:aws:s3:::www.example.com/*` with `s3:GetObject`.
3) How do Origin Access Control (OAC) / Origin Access Identity (OAI) change this?
OAC/OAI makes the bucket private while CloudFront gets access via a dedicated identity. Use it when you don’t want public listing or direct S3 URL access. Keep bucket objects private and let CloudFront serve them with signed URLs if needed.
4) Which certificate do I need in CloudFront?
Use an ACM certificate in us-east-1 for the CloudFront distribution. Include both the apex and www names if you serve both. For wildcard coverage, request `*.example.com` plus the bare apex if your use case needs it.
5) Why does CloudFront keep returning the S3 REST endpoint or redirecting to the bucket website endpoint?
Check the origin domain name. For S3 website hosting use the bucket website endpoint; for private origin access use the bucket regional REST endpoint. Mismatched endpoints break redirects and 404 behavior.
6) How does caching affect HTTPS changes?
CloudFront caches at the edge and by default honors Cache-Control. After a cert or origin change, invalidate affected paths or use versioned asset filenames to avoid stale responses. For HTML, cache at low TTL.