All checks
Medium
CloudFront distributions should use origin access control
Checks that every S3 origin of a CloudFront distribution uses origin access control (OAC), which lets the bucket refuse direct requests so its content is reached only through CloudFront. A legacy origin access identity (OAI) fails. The check reads the attachment only: it passes while the bucket policy still allows public access.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
- Interrupts service: Add the bucket policy statement before attaching the OAC, and remove public or OAI access only after the distribution finishes deploying, or viewers get errors in between.
- Can break clients: Anything reading objects straight from the bucket's own URL loses access once public grants are removed, so move it to the distribution's domain first.
- Affects another check: Object Ownership set to Bucket owner enforced also clears S3.12 on the bucket; Bucket owner preferred, kept for ACLs, leaves S3.12 failing.
In the console
CloudFront → Distributions → the distribution → Origins → the S3 origin → Edit
- Origin access
- Origin access control settings (recommended); a legacy origin access identity still fails
- Origin access control
- One with Origin type S3 and Signing behavior Sign requests (recommended); this check does not read it
- S3 → Permissions → Bucket policy
- Allow cloudfront.amazonaws.com with AWS:SourceArn set to this distribution's ARN; then remove public and OAI grants
- S3 → Permissions → Object Ownership
- ACLs disabled (recommended), which is Bucket owner enforced; Bucket owner preferred if you need ACLs
- Key Management Service → the key → Key policy
- For SSE-KMS: cloudfront.amazonaws.com gets kms:Decrypt, kms:Encrypt and kms:GenerateDataKey* under that AWS:SourceArn
See which of your accounts this check is failing on.
Book a live scan