{"id":16771628,"url":"https://github.com/meysam81/cross-account-cloudfront-s3","last_synced_at":"2026-04-19T10:31:53.112Z","repository":{"id":99614461,"uuid":"562724117","full_name":"meysam81/cross-account-cloudfront-s3","owner":"meysam81","description":"CloudFormation Templates for Cross-Account CloudFront Distribution with S3 Origin","archived":false,"fork":false,"pushed_at":"2022-11-07T05:49:31.000Z","size":4,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-07-21T00:42:33.226Z","etag":null,"topics":["aws","aws-cloudformation","aws-cloudfront","aws-cloudfront-edge","aws-s3","aws-s3-bucket","aws-s3-cloudfront","awscli","awscliv2","iac"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/meysam81.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-11-07T05:45:08.000Z","updated_at":"2023-03-04T10:14:25.000Z","dependencies_parsed_at":"2023-07-31T04:45:06.402Z","dependency_job_id":null,"html_url":"https://github.com/meysam81/cross-account-cloudfront-s3","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/meysam81/cross-account-cloudfront-s3","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meysam81%2Fcross-account-cloudfront-s3","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meysam81%2Fcross-account-cloudfront-s3/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meysam81%2Fcross-account-cloudfront-s3/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meysam81%2Fcross-account-cloudfront-s3/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/meysam81","download_url":"https://codeload.github.com/meysam81/cross-account-cloudfront-s3/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/meysam81%2Fcross-account-cloudfront-s3/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32004019,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-18T20:23:30.271Z","status":"online","status_checked_at":"2026-04-19T02:00:07.110Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-cloudformation","aws-cloudfront","aws-cloudfront-edge","aws-s3","aws-s3-bucket","aws-s3-cloudfront","awscli","awscliv2","iac"],"created_at":"2024-10-13T06:28:46.547Z","updated_at":"2026-04-19T10:31:53.095Z","avatar_url":"https://github.com/meysam81.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cross Account CloudFront S3\n\n\u003c!-- START doctoc generated TOC please keep comment here to allow auto update --\u003e\n\u003c!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE --\u003e\n\n- [Cross Account CloudFront S3](#cross-account-cloudfront-s3)\n  - [Prerequisites](#prerequisites)\n    - [AWS Configure](#aws-configure)\n  - [Usage](#usage)\n  - [How it works](#how-it-works)\n  - [Cleanup](#cleanup)\n\n\u003c!-- END doctoc generated TOC please keep comment here to allow auto update --\u003e\n\nInfrastructure as Code (IaC) for a CloudFront distribution that serves content\nfrom a private S3 bucket in a different AWS account.\n\n## Prerequisites\n\n- [AWS CLI](https://aws.amazon.com/cli/)\n- Two AWS accounts [configured](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html)\nwith **different profile names**.\n- A [public hosted zone in AWS Route53](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/AboutHZWorkingWith.html)\nin the account where the CloudFront distribution will be created.\n\n### AWS Configure\n\nUpon running `aws configure --profile account1` and\n`aws configure --profile account2`, you will have a file in\n`~/.aws/credentials` that looks like this:\n\n```ini\n[account1]\naws_access_key_id = \u003cyour access key id\u003e\naws_secret_access_key = \u003cyour secret access key\u003e\n\n[account2]\naws_access_key_id = \u003cyour access key id\u003e\naws_secret_access_key = \u003cyour secret access key\u003e\n```\n\nAlso, the config file `~/.aws/config` will look like this:\n\n```ini\n[profile account1]\nregion = us-east-1\n\n[profile account2]\nregion = us-east-1\n```\n\nYou will then pass `account1` and `account2` as `ACCOUNT_A_PROFILE` \u0026\n`ACCOUNT_B_PROFILE` variables in the `deploy.sh` and `cleanup.sh` scripts.\n\n## Usage\n\nFill in the required values in the [deploy.sh](deploy.sh) script and run it.\n\n## How it works\n\n1. First, a new S3 bucket will be created in the first account, optionally with\nencryption enabled. This bucket will be private and only accessible by the\naccount owner and the CloudFront distribution in the second account.\n2. The bucket name will be passed to the second step, which will create a new\nCloudFront distribution that will serve the content from the S3 bucket hosted\nin the first account. The access to the private bucket is made possible by\ntwo pieces:\n    - The [Origin Access Control](https://aws.amazon.com/blogs/networking-and-content-delivery/amazon-cloudfront-introduces-origin-access-control-oac/)\nused by the CloudFront distribution.\n    - The bucket policy applied on the S3 bucket in the third step below.\n3. The bucket policy will be created in the first account, allowing the\nCloudFront distribution to access the S3 bucket. The policy will be created\nusing the CloudFront distribution's Origin Access Control (OAC) ID as the\nprincipal. This will allow the CloudFront distribution to access the S3 bucket\nwithout needing to expose the bucket publicly i.e. ensuring that the objects\nare not accessible through the S3 bucket URL e.g. static website.\n\n## Cleanup\n\nFill in the required values in the [cleanup.sh](cleanup.sh) script and run it.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmeysam81%2Fcross-account-cloudfront-s3","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmeysam81%2Fcross-account-cloudfront-s3","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmeysam81%2Fcross-account-cloudfront-s3/lists"}