Reading thru the S3Origin construct it appears the only permission granted to the associated CloudFront distribution is s3:GetObject. However, without s3:ListBucket, CloudFront has no way of returning a 404 response to callers and instead returns HTTP 403 Forbidden.

Use Case

It would be nice for S3Origin construct to provide all the necessary permissions for an associated CloudFront distribution to respond via HTTP. After using this construct its unintuitive to have my CloudFront distribution responding to callers with 403 for resources that are otherwise missing per HTTP spec.

Proposed Solution

Add s3:ListBucket in addition to the current s3:GetObject for the resource policy of the S3 bucket for given CloudFront distribution.