CloudFront distributions should use origin access control
Verifies that CloudFront distributions with S3 origins use origin access control (OAC) to restrict direct S3 access.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
Attach an origin access control to every S3 origin, then close the bucket to everyone else: its bucket policy allows the cloudfront.amazonaws.com service principal under a condition naming this distribution's ARN, and whatever granted access before, public read or a legacy origin access identity, comes off. Grant the new access before removing the old, or the site goes dark between the two edits. Confirm two things the finding cannot see: the origin access control's signing behavior is set to sign requests, and objects encrypted with SSE-KMS have a matching statement on the key policy.
In the console
CloudFront → Distributions → the distribution → Origins → the S3 origin → Origin access
See which of your accounts this check is failing on.
Book a demo