Check if CloudFront distributions with S3 origin use OAC.
cloudfront_distributions_s3_origin_access_control
Check if CloudFront distributions use origin access control.
Risk
Without OAC, your S3 bucket could be accessed directly, bypassing CloudFront, which could expose your content to unauthorized access. Additionally, relying on Origin Access Identity (OAI) may limit functionality and security features, making your distribution less secure and more difficult to manage.
Run this check with Prowler CLI
prowler aws --checks cloudfront_distributions_s3_origin_access_control
ARN template
arn:partition:cloudfront:region:account-id:distribution/resource-id
Remediation
https://docs.prowler.com/checks/aws/iam-policies/ensure-aws-cloudfromt-distribution-with-s3-have-origin-access-set-to-enabled/
https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudFront/s3-origin.html
https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html#cloudfront-13
Configure Origin Access Control (OAC) for CloudFront distributions that use an Amazon S3 origin. This will ensure that the content in your S3 bucket is accessible only through the specified CloudFront distribution, enhancing security by preventing direct access to the bucket.
Source Code
Resource Type
AWSCloudFrontDistribution