Question

A media company serves static video assets from an S3 bucket through a CloudFront distribution. The security team discovers that users can bypass CloudFront and download objects directly using the S3 bucket's website endpoint URLs, avoiding WAF rules and geo-restrictions applied at the edge. The team wants to ensure all access to the S3 objects is only possible through CloudFront, using the most current AWS-recommended mechanism. What should they implement?

Accepted Answer

Configure an Origin Access Control (OAC) on the CloudFront distribution and update the S3 bucket policy to allow access only from that distribution via the aws:SourceArn condition, while blocking all other principals.

Answer

Enable S3 Block Public Access on the bucket and add a bucket policy that allows the CloudFront service principal without any condition keys.

Answer

Attach a custom secret header at CloudFront and use an S3 bucket policy that validates the header value on every GetObject request.

Answer

Create a legacy Origin Access Identity (OAI), associate it with the origin, and enable the S3 static website hosting endpoint as the CloudFront origin.