`additional_bucket_policy` has no effect about terraform-aws-cloudfront-s3-cdn

[gecugamo]

Update: I was using the wrong syntax.

You need to do something like this:

data "aws_iam_policy_document" "overrides" {
  statement {
    sid    = "S3GetObjectForCloudFront"

    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = [
        "$${cloudfront_origin_access_identity_iam_arn}"
      ]
    }
    actions   = ["s3:GetObject"]
    resources = ["arn:aws:s3:::$${bucket_name}$${origin_path}*"]
  }

  statement {
    sid    = "S3ListBucketForCloudFront"

    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = [
        "$${cloudfront_origin_access_identity_iam_arn}"
      ]
    }
    actions   = ["s3:ListBucket"]
    resources = ["arn:aws:s3:::$${bucket_name}"]
  }
}

module "cdn" {
  source  = "cloudposse/cloudfront-s3-cdn/aws"
  version = "0.83.0"
  name    = "Policy Overrides Example"

  origin_bucket                      = "foobar"
  origin_path                        = "/bazqux"
  override_origin_bucket_policy      = true
  additional_bucket_policy           = data.aws_iam_policy_document.overrides.json
}

Resources

• Data Source: aws_iam_policy_document