CloudFront distributions should use origin access control

NIST

Description

Verifies that CloudFront distributions with S3 origins use origin access control (OAC) to restrict direct S3 access.

To configure OAC for a CloudFront distribution with S3 origins, follow these steps:

Open the Amazon CloudFront console.
Select the distribution you want to modify.
Go to the 'Origins and Origin Groups' tab.
Select the origin and choose 'Edit'.
In the 'Origin Access Control' section, select the appropriate OAC configuration.
Save the changes.

NIST