{
  "Version":"2012-10-17",
  "Id":"PolicyForCloudFrontPrivateContent",
  "Statement":[
    {
      "Sid":" Grant a CloudFront Origin Identity access to support private content",
      "Effect":"Allow",
      "Principal":{"CanonicalUser":"${origin_access_identity}"},
      "Action":"s3:GetObject",
      "Resource":"arn:aws:s3:::${bucket_name}/*"
    }
  ]
}