All checks
High
CloudFront distributions should not point to non-existent S3 origins
Detects CloudFront S3 origins whose bucket no longer exists: anyone can create a bucket with that name and serve their own content through the distribution. The finding ID is the distribution ID and the bucket name, joined by a colon.
- service
- CloudFront
- severity
- High
- scope
- evaluated once per account
How to fix it
In the console
CloudFront → Distributions → the distribution → Origins
- Origin domain
- A bucket that exists, or delete the origin; or recreate the missing bucket under the same name in this account
- Behaviors → Origin or origin group
- Another origin for each behavior using this one, before deleting it: deletion is refused until then
See which of your accounts this check is failing on.
Book a live scan