Amazon CloudFront now supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points

Amazon CloudFront OAC Support for Amazon S3 MRAP Origins

Starting today, customers can protect their origins using Amazon S3 Multi-Region Access Points (MRAP) by using CloudFront Origin Access Control (OAC) to only allow access from designated CloudFront distributions. Customers use Amazon S3 MRAP with CloudFront to serve content from a single global endpoint that automatically routes to the closest available replicated bucket across regions during a cache miss, improving performance and resilience for globally distributed users. Previously, customers had to compute and forward their own Asymmetric Signature Version 4 (SigV4a) Authorization header using a custom Lambda@Edge Function. Now, CloudFront natively signs requests to S3 MRAP origins. Customers get faster cache-miss fills from the nearest region and restricted, OAC-secured MRAP access without custom Authorization header computation.

What to do

• Use the CloudFront Console, SDK, CLI, or CloudFormation to enable OAC when configuring your Amazon S3 MRAP endpoint with CloudFront.
• Refer to the CloudFront Developer Guide for more information.

CloudFront OAC support for Amazon S3 MRAP origins is available worldwide, except in the CloudFront China region. There are no additional fees associated with this feature.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.