I created a new demo projects using `pulumi new t static web Pulumi Community #general

I created a new demo projects using `pulumi new -t...

little-cartoon-10569

02/26/2026, 2:11 AM

I created a new demo projects using

pulumi new -t static-website-aws-csharp

. It deployed fine but everything was giving me 403s (until I sorted the permissions) then 404s (until I fixed the paths). I think the template needs to be updated, with the core of the problem being the SyncedFolder; it seems to have been designed with ACLs in mind, and they're no longer AWS' first choice and things have broken.

little-cartoon-10569

02/26/2026, 2:12 AM

It looks like removing all ACLs, using two simple BucketObjects for the two files, adding a public bucket policy, and changing the bucket ownership controls to BucketOwnerEnforced (which is the default these days) works and makes the code simpler.

little-cartoon-10569

02/26/2026, 2:31 AM

Though I wouldn't mind it if CloudFront's access worked but the direct http access didn't. I guess that's due to my bucket policy, which has

Principal: "*"

. Let's see if I can make that

Service: "<http://cloudfront.amazonaws.com|cloudfront.amazonaws.com>"

and keep it working....

👀 1

little-cartoon-10569

02/26/2026, 8:57 PM

(Update: it didn't keep working; have been working on it for a few hours. Still trying.)

little-cartoon-10569

02/27/2026, 2:30 AM

Got it all working. Found this page and took the important bits from it: https://www.pulumi.com/guides/how-to/aws-cloudfront-distribution/ There's a lot in there that's exactly the same as the defaults and can be safely omitted.

little-cartoon-10569

02/27/2026, 2:32 AM

Essentially: use OAC, don't use the S3 website configuration stuff. This allows CloudFront HTTPS and denies all S3 direct access. Simpler code, and a more secure/private result.

3 Views

Open in Slack

Previous Next