CloudFront distribution should use origin access identity or control

High AWS General aws-cloudfront-distribution-cloudfront-distributio-2

Applies to

AWS::CloudFront::Distribution

What CGPulse checks

A resource passes this rule when originAccessControl must be set true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Configure Origin Access Control (OAC) to restrict direct S3 bucket access through CloudFront only. In AWS Console: CloudFront > Origins > Edit > set Origin Access Control. See: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html

Terraform

resource "aws_cloudfront_distribution" "{name}" {
  origin {
    origin_access_control_id = aws_cloudfront_origin_access_control.{name}.id
  }
}

Compliance frameworks

Cloud Security: AWS Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan