Set up OAC between CloudFront and your bucket with aws:SourceArn.

100 policies cloudfront s3