source/client/template-one-click.yaml [58:107]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  CloudFrontOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: "S3 CloudFront OAI"
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        DefaultCacheBehavior:
          ForwardedValues:
            QueryString: false
          TargetOriginId: the-s3-bucket
          ViewerProtocolPolicy: redirect-to-https
        DefaultRootObject: index.html
        Enabled: true
        Logging:
          Bucket: !Sub "${LoggingBucket}.s3.amazonaws.com"
          Prefix: "cloudfront-distribution/"
        Origins:
          - DomainName: !Sub "${StaticWebsiteBucket}.s3.${AWS::Region}.amazonaws.com"
            Id: the-s3-bucket
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W70
            reason: Minimum protocol version not supported with distribution that uses the CloudFront domain name.
  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref StaticWebsiteBucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
            Principal:
              CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId
            Resource: !Sub "arn:aws:s3:::${StaticWebsiteBucket}/*"
          - Effect: Deny
            Action: "*"
            Principal: "*"
            Resource:
              - !Sub "arn:aws:s3:::${StaticWebsiteBucket}/*"
              - !Sub "arn:aws:s3:::${StaticWebsiteBucket}"
            Condition:
              Bool:
                aws:SecureTransport: false
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



source/client/template.yaml [58:107]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  CloudFrontOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: "S3 CloudFront OAI"
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        DefaultCacheBehavior:
          ForwardedValues:
            QueryString: false
          TargetOriginId: the-s3-bucket
          ViewerProtocolPolicy: redirect-to-https
        DefaultRootObject: index.html
        Enabled: true
        Logging:
          Bucket: !Sub "${LoggingBucket}.s3.amazonaws.com"
          Prefix: "cloudfront-distribution/"
        Origins:
          - DomainName: !Sub "${StaticWebsiteBucket}.s3.${AWS::Region}.amazonaws.com"
            Id: the-s3-bucket
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W70
            reason: Minimum protocol version not supported with distribution that uses the CloudFront domain name.
  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref StaticWebsiteBucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
            Principal:
              CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId
            Resource: !Sub "arn:aws:s3:::${StaticWebsiteBucket}/*"
          - Effect: Deny
            Action: "*"
            Principal: "*"
            Resource:
              - !Sub "arn:aws:s3:::${StaticWebsiteBucket}/*"
              - !Sub "arn:aws:s3:::${StaticWebsiteBucket}"
            Condition:
              Bool:
                aws:SecureTransport: false
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



