Question

A media company serves static assets to global users from an S3 bucket that is currently configured as a public website endpoint fronted by CloudFront. A recent security audit flagged that the bucket allows anonymous public access and that assets can be retrieved directly from the S3 website URL, bypassing CloudFront (and therefore WAF rules and access logging). The team must remediate this exposure so that assets are only reachable through CloudFront, without changing the object keys or breaking existing viewer URLs. Which approach best meets these requirements with the least ongoing operational overhead?

Accepted Answer

Configure a CloudFront Origin Access Control (OAC) for the distribution, switch the origin to the S3 REST (bucket) endpoint, block all public access on the bucket, and update the bucket policy to allow access only from the CloudFront distribution's service principal.

Answer

Keep the S3 website endpoint origin but add a custom secret header on the CloudFront origin request and configure a bucket policy that requires that header value.

Answer

Enable S3 Block Public Access and rely on a signed-cookie-only viewer policy while leaving the origin pointed at the public website endpoint.

Answer

Create a Lambda@Edge function that authenticates every viewer request and rewrites the origin URL to a presigned S3 URL generated on each request.