Amazon CloudFront now supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points

Amazon Web Services announced that CloudFront Origin Access Control (OAC) now supports Amazon S3 Multi-Region Access Points (MRAP), enabling customers to secure origins by restricting access to specific CloudFront distributions. Previously, users had to manually compute and forward SigV4a Authorization headers via Lambda@Edge functions, adding complexity. The new integration eliminates this requirement, allowing CloudFront to natively sign requests to S3 MRAP origins. This change simplifies deployment while maintaining security and performance benefits for globally distributed users.

The update enhances performance by enabling faster cache-miss fills from the nearest available S3 bucket region, as CloudFront automatically routes requests to the closest replicated bucket during misses. Customers leveraging S3 MRAP with CloudFront benefit from improved resilience and reduced latency for end-users accessing content globally. The feature is available worldwide, excluding the CloudFront China region, and integrates seamlessly with existing CloudFront and S3 MRAP configurations.

To implement the new capability, customers can enable OAC through the CloudFront Console, SDK, CLI, or CloudFormation when configuring their S3 MRAP endpoint with CloudFront. AWS provides documentation in the CloudFront Developer Guide to guide the process. The feature does not introduce additional fees, maintaining cost efficiency for existing and new deployments.

This enhancement aligns with AWS’s ongoing efforts to streamline security and performance for content delivery networks. By removing the need for custom Lambda@Edge functions, AWS reduces operational overhead while ensuring secure, controlled access to S3 MRAP origins via CloudFront distributions.