Following up on a question from a few days ago: I ...
# dotnetl
little-cartoon-10569
02/26/2026, 3:24 AMFollowing up on a question from a few days ago: I found a page that shows how to nicely build policy docs thus:
Copy code
new BucketPolicyArgs {
Bucket = bucket.Id,
Policy = Output.JsonSerialize(Output.Create(new {
Version = "2012-10-17",
Statement = new[] {
new {
Effect = "Allow",
Principal = new {
AWS = Output.Format($"arn:aws:iam::{accountID}:root")
},
Action = "s3:ListBucket",
Resource = bucket.Arn
}
}
}
} Copy code
"Condition": {
"StringEquals": {
"AWS:SourceArn": "arn:aws:cloudfront::<YOUR_AMAZON_ACCOUNT_ID>:distribution/<CLOUDFRONT_DISTRIBUTION_ID>"
}
}AWS:SourceArnlittle-cartoon-10569
02/26/2026, 3:47 AMTo answer my own question: use a Dictionary.
Copy code
// ...
Statement = new[] {
new {
Sid = "PublicReadGetObject",
Effect = Aws.Iam.PolicyStatementEffect.ALLOW.ToString(),
Principal = new
{
Service = "<http://cloudfront.amazonaws.com|cloudfront.amazonaws.com>"
},
Action = "s3:GetObject",
Resource = Output.Format($"arn:aws:s3:::{bucket.BucketName}/*"),
Condition = new
{
StringEquals = new Dictionary<string, Output<string>>
{
["AWS:SourceArn"] = Output.Format($"arn:aws:cloudfront::{accountId}:distribution/{cdn.Id}")
}
}
}
}🙌 1
âž• 1