# CloudFront OAC Setup

These files configure CloudFront Origin Access Control for the private S3 bucket `002095-offline-maps`.

## Files

- `oac-config.json` creates an Origin Access Control.
- `s3-bucket-policy.template.json` allows one CloudFront distribution to read objects from the bucket.

## Steps

1. Find your CloudFront distribution ID for `d1kqaf73sbxp1p.cloudfront.net`.

2. Replace `YOUR_DISTRIBUTION_ID` in `s3-bucket-policy.template.json`.

3. Create OAC:

```bash
aws cloudfront create-origin-access-control \
  --origin-access-control-config file://aws/cloudfront-oac/oac-config.json
```

4. Copy the returned `OriginAccessControl.Id`.

5. Edit your CloudFront distribution origin:

- Set `OriginAccessControlId` to the OAC ID.
- Clear the old `S3OriginConfig.OriginAccessIdentity` value to an empty string.
- Keep the origin domain as the S3 regional domain, for example:
  `002095-offline-maps.s3.us-east-2.amazonaws.com`

6. Apply the S3 bucket policy:

```bash
aws s3api put-bucket-policy \
  --bucket 002095-offline-maps \
  --policy file://aws/cloudfront-oac/s3-bucket-policy.template.json \
  --region us-east-2
```

7. Invalidate CloudFront:

```bash
aws cloudfront create-invalidation \
  --distribution-id YOUR_DISTRIBUTION_ID \
  --paths "/offline-maps/*"
```

## Required IAM Permissions

The current AWS key used by the app has S3 access but did not have CloudFront read permissions. To complete this setup from CLI, the IAM user/role needs permissions such as:

```json
{
  "Effect": "Allow",
  "Action": [
    "cloudfront:ListDistributions",
    "cloudfront:GetDistributionConfig",
    "cloudfront:UpdateDistribution",
    "cloudfront:CreateOriginAccessControl",
    "cloudfront:CreateInvalidation"
  ],
  "Resource": "*"
}
```