title: CloudFront Distribution with S3 Origin Responds with XML ListBucketResult
body: <p>My intention is to have my static website files (in React, if that's a factor) accessible only via my domain and not directly through S3 URLs. It seems to be working on my own computer (though that might be CloudFront cache from when the bucket was public), but other clients receive only S3 messages in XML. Requesting the domain without any path gives a  response. Requesting any path (e.g. /index.html, a file in my bucket) gives a  response with the code NoSuchKey.</p>
  
  <p>What am I doing wrong? Here's the current configuration.</p>
  
  <ul>
  <li>In Route 53, I'm pointing the appropriate subdomain at the CloudFront distribution with a CNAME record (xxxxxxxxxxx.cloudfront.net.)</li>
  <li>In ACM, I have a certificate that covers the subdomain (*.mydomain.com)</li>
  <li>In CloudFront, I have a distribution with those domain name (xxxxxxxxxxx.cloudfront.net) and alternate domain name (subdomain.mydomain.com). - It's enabled and has been in the deployed state for several hours now.</li>
  <li>It has a single origin, with domain name subdomain.mydomain.com.s3.amazonaws.com</li>
  <li>I chose to restrict bucket access and selected an existing identity for origin access. I had CloudFront update the bucket policy earlier today.</li>
  <li>The distribution has a single behavior record which redirects HTTP to HTTPS and only allows GET and HEAD methods</li>
  <li>My S3 bucket name matches the Route 53 record (subdomain.mydomain.com)</li>
  <li>Static website hosting is enabled, with both the index and error documents set to index.html</li>
  <li>The bucket policy was autogenerated. It includes a single identity and limits use to the s3:GetObject action on resource arn:aws:s3:::subdomain.mydomain.com/*</li>
  <li>CORS configuration is empty</li>
  <li>Inside the bucket is a React app, with index.html as its entry point.</li>
  </ul>
  
  <p>Edit: my bucket policy (<strong>do I need to add another action?</strong>)</p>
  
  <pre><code>{
      "Version": "2008-10-17",
      "Id": "PolicyForCloudFrontPrivateContent",
      "Statement": [
          {
              "Sid": "1",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EZOBXXXXXXXXX"
              },
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::subdomain.mydomain.com/*"
          }
      ]
  }
  </code></pre>