code: private void setBucketAccessPolicy(String bucketName, String oaIdentityId) {
          CloudFrontOriginAccessIdentity cfOAIdentity =
              cfClient.getCloudFrontOriginAccessIdentity(
                  new GetCloudFrontOriginAccessIdentityRequest(oaIdentityId))
                      .getCloudFrontOriginAccessIdentity();
          String s3UserId = cfOAIdentity.getS3CanonicalUserId();
  
          StringBuilder policyText = new StringBuilder();
          policyText.append("{\"Version\":\"2012-10-17\",");
          policyText.append("\"Id\":\"PolicyForCloudFrontPrivateContent\",");
          policyText.append("\"Statement\":[{");
          policyText.append("\"Sid\":\"Grant CloudFront access to private content\",");
          policyText.append("\"Effect\":\"Allow\",");
          policyText.append("\"Principal\":{\"CanonicalUser\":\"" + s3UserId + "\"},");
          policyText.append("\"Action\":\"s3:GetObject\",");
          policyText.append("\"Resource\":\"arn:aws:s3:::" + bucketName + "/*\"");
          policyText.append("}]}");
          s3Client.setBucketPolicy(bucketName, policyText.toString());
      }
docs: /*
  Updates the bucket policy to allow GET access to the cloudfront origin
  access identity. This allows Cloudfront to access content in S3
  
  @return results of the ACL setting activity