AWS AmazonCloudFront documentation change
Summary
Updated terminology from 'OAC permission' to 'CloudFront permission', added MQAR-related IAM policy requirement for HEAD requests, and enhanced policy configuration guidance
Security assessment
The changes clarify IAM policy requirements for CloudFront origin access control, including a new mediapackagev2:GetHeadObject action required for MQAR functionality. While this ensures proper configuration of security controls, there is no evidence of addressing an existing vulnerability. The updates improve documentation accuracy for secure access management but do not patch a specific security issue.
Diff
diff --git a/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-mediapackage.md b/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-mediapackage.md index abf67b4c4..338c35a23 100644 --- a//AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-mediapackage.md +++ b//AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-mediapackage.md @@ -32 +32 @@ Complete the steps described in the following topics to set up a new OAC in Clou - * Giving the OAC permission to access the MediaPackage v2 origin + * Grant CloudFront permission to access the MediaPackage v2 origin @@ -43 +43 @@ Before you create and set up OAC, you must have a CloudFront distribution with a -### Giving the OAC permission to access the MediaPackage v2 origin +### Grant CloudFront permission to access the MediaPackage v2 origin @@ -45 +45 @@ Before you create and set up OAC, you must have a CloudFront distribution with a -Before you create an OAC or set it up in a CloudFront distribution, make sure the OAC has permission to access the MediaPackage v2 origin. Do this after you create a CloudFront distribution, but before you add the OAC to the MediaPackage v2 origin in the distribution configuration. +Before you create an OAC or set it up in a CloudFront distribution, make sure that CloudFront has permission to access the MediaPackage v2 origin. Do this after you create a CloudFront distribution, but before you add the OAC to the MediaPackage v2 origin in the distribution configuration. @@ -47 +47 @@ Before you create an OAC or set it up in a CloudFront distribution, make sure th -To give the OAC permission to access the MediaPackage v2 origin, use a IAM policy to allow the CloudFront service principal (`cloudfront.amazonaws.com`) to access the origin. The `Condition` element in the policy allows CloudFront to access the MediaPackage v2 origin _only_ when the request is on behalf of the CloudFront distribution that contains the MediaPackage v2 origin. +Use an IAM policy to allow the CloudFront service principal (`cloudfront.amazonaws.com`) to access the origin. The `Condition` element in the policy allows CloudFront to access the MediaPackage v2 origin _only_ when the request is on behalf of the CloudFront distribution that contains the MediaPackage v2 origin. This is the distribution with the MediaPackage v2 origin that you want to add OAC to. @@ -49 +49 @@ To give the OAC permission to access the MediaPackage v2 origin, use a IAM polic -###### Example : IAM policy that allows read-only access to a CloudFront distribution +###### Example : IAM policy that allows read-only access for a CloudFront distribution with OAC enabled @@ -70 +70,7 @@ The following policy allows the CloudFront distribution (``E1PDK09ESKHJWT``) acc -###### Note +###### Notes + + * If you enabled the MQAR feature and origin access control (OAC), add the `mediapackagev2:GetHeadObject` action to the IAM policy. MQAR requires this permission to send `HEAD` requests to the MediaPackage v2 origin. For more information about MQAR, see [Media quality-aware resiliency](./media-quality-score.html). + + * If you create a distribution that doesn't have permission to your MediaPackage v2 origin, you can choose **Copy policy** from the CloudFront console and then choose **Update endpoint permissions**. You can then attach the copied permission to the endpoint. For more information, see [Endpoint policy fields](https://docs.aws.amazon.com/mediapackage/latest/userguide/endpoints-policy.html) in the _AWS Elemental MediaPackage User Guide_. + + @@ -72 +77,0 @@ The following policy allows the CloudFront distribution (``E1PDK09ESKHJWT``) acc -If you create a distribution that doesn't have permission to your MediaPackage v2 origin, you can choose **Copy policy** from the CloudFront console and then choose **Update endpoint permissions**. You can then attach the copied permission to the endpoint. For more information, see [Endpoint policy fields](https://docs.aws.amazon.com/mediapackage/latest/userguide/endpoints-policy.html) in the _AWS Elemental MediaPackage User Guide_.