code: def set_permissions(self, object, replace=False):
          
          if isinstance(self.config.origin, S3Origin):
              if self.config.origin.origin_access_identity:
                  id = self.config.origin.origin_access_identity.split('/')[-1]
                  oai = self.connection.get_origin_access_identity_info(id)
                  policy = object.get_acl()
                  if replace:
                      policy.acl = ACL()
                  policy.acl.add_user_grant('READ', oai.s3_user_id)
                  object.set_acl(policy)
              else:
                  object.set_canned_acl('public-read')
docs: Sets the S3 ACL grants for the given object to the appropriate
          value based on the type of Distribution.  If the Distribution
          is serving private content the ACL will be set to include the
          Origin Access Identity associated with the Distribution.  If
          the Distribution is serving public content the content will
          be set up with "public-read".
  
          :type object: :class:`boto.cloudfront.object.Object`
          :param enabled: The Object whose ACL is being set
  
          :type replace: bool
          :param replace: If False, the Origin Access Identity will be
                          appended to the existing ACL for the object.
                          If True, the ACL for the object will be
                          completely replaced with one that grants
                          READ permission to the Origin Access Identity.