Question

A company serves static content from a private S3 bucket through a CloudFront distribution. Security review reveals that the S3 objects can still be downloaded directly using their public S3 URLs, bypassing CloudFront (and its attached WAF web ACL). The team must ensure content is only reachable through CloudFront while following current AWS best practices. What should they implement?

Accepted Answer

Configure an Origin Access Control (OAC) on the CloudFront origin and update the S3 bucket policy to allow only the distribution's service principal, while keeping public access blocked.

Answer

Enable S3 Block Public Access on the bucket and rely on CloudFront's default behavior to make direct object access impossible.

Answer

Attach the WAF web ACL directly to the S3 bucket so the same Layer 7 rules are enforced regardless of access path.

Answer

Make the S3 bucket public and add a bucket policy that only allows requests originating from CloudFront edge location IP ranges.