Check provider logo

CloudFront distribution uses Origin Access Control (OAC) for all S3 origins

cloudfront_distributions_s3_origin_access_control

Severitymedium
Servicecloudfront
by Prowler
trust-boundariesinternet-exposed

CloudFront distributions with Amazon S3 origins are expected to use Origin Access Control (OAC) on each S3 origin.

The evaluation inspects distributions that include s3_origin_config and identifies S3 origins that lack an associated OAC.

Risk

Without OAC, S3 objects can be reached outside CloudFront, bypassing edge controls and weakening confidentiality and integrity.

  • Direct access enables data exfiltration
  • Loss of WAF, rate-limiting, and detailed logging; cost abuse
  • Limited support for signed writes and SSE-KMS, increasing tampering risk
Run this check with Prowler CLI

prowler aws --checks cloudfront_distributions_s3_origin_access_control

Run in Prowler Cloud

Recommendation

Enable Origin Access Control for all S3 origins and keep buckets non-public.

Apply least privilege: scope bucket and key permissions to CloudFront and the intended distribution. Ensure origin requests are signed, migrate from legacy OAI, and use defense in depth with WAF and monitoring to protect and observe access.

Remediation

CLI

aws cloudfront create-origin-access-control --origin-access-control-config '{Name":"<example_resource_name>","SigningProtocol":"sigv4","SigningBehavior":"always","OriginAccessControlOriginType":"s3"}' && aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --output json > current-config.json && echo 'Manually edit current-config.json to add OriginAccessControlId to S3 origins, then run:' && echo 'aws cloudfront update-distribution --id <DISTRIBUTION_ID> --distribution-config file://current-config.json --if-match $(aws cloudfront get-distribution-config --id <DISTRIBUTION_ID> --query "ETag" --output text)'

Native IaC
Terraform
Other
  1. In the AWS Console, open CloudFront and go to Security > Origin access > Origin access control (OAC). Click Create control setting, choose Origin type S3, keep Sign requests, and create the OAC.
  2. Open your CloudFront distribution, go to the Origins tab.
  3. For each S3 origin: click Edit, select Origin access control settings (recommended), choose the OAC created in step 1, and Save changes.
  4. Repeat step 3 for all S3 origins in the distribution.

Source Code

Resource Type

AwsCloudFrontDistribution

References