CloudFront Origin Access Control

Photo by vackground.com on Unsplash

CloudFront Origin Access Control

AWS/Security

Taegu Kang's photo
Taegu Kang
·

1 min read

  • outline

Access control and security enhancement for CloudFront, OAC is next generation of OAI.

  • Origin Access : Create control setting
Signing behavior
Sign requests (recommended)
Create

Bucket Policy -> Copy policy
  • S3 bucket policy
{
        "Version": "2008-10-17",
        "Id": "PolicyForCloudFrontPrivateContent",
        "Statement": [
            {
                "Sid": "AllowCloudFrontServicePrincipal",
                "Effect": "Allow",
                "Principal": {
                    "Service": "cloudfront.amazonaws.com"
                },
                "Action": "s3:GetObject",
                "Resource": "arn:aws:s3:::test/*",
                "Condition": {
                    "StringEquals": {
                      "AWS:SourceArn": "arn:aws:cloudfront::123456789:distribution/ABCD123ASDB"
                    }
                }
            }
        ]
}
  • reference

https://aws.amazon.com/ko/blogs/korea/amazon-cloudfront-introduces-origin-access-control-oac/
aws.amazon.com/ko/blogs/networking-and-cont..

AWScloudfrontSecurityoacoai