Back to All Checks
Medium CloudFront

CloudFront distributions should use origin access control for Lambda function URL origins

Description

Flags Amazon CloudFront distributions that use AWS Lambda function URLs as origins without origin access control (OAC) enabled. Without OAC, the Lambda function URL is publicly reachable and bypasses the protections CloudFront provides.

Remediation

Configure OAC on every Lambda function URL origin in a CloudFront distribution.

Steps

  1. Open the CloudFront console and select the distribution.
  2. Choose Origins, then edit the Lambda function URL origin.
  3. Under Origin access, select Origin access control settings and choose or create an OAC for Lambda.
  4. Update the Lambda function's resource policy to allow the OAC principal.
  5. Save the changes.
Start Your Free Security Check