AWS AmazonCloudFront medium security documentation change
Summary
Updated terminology from 'origin access control (OAC)' to 'CloudFront' in multiple sections, clarified that permissions are granted to CloudFront service principal rather than OAC entity, and updated policy examples to reference CloudFront distributions with OAC enabled
Security assessment
The changes emphasize proper IAM policy configuration for CloudFront service principal access to MediaStore origins, reducing risk of misconfiguration that could allow unauthorized access. The explicit focus on restricting via distribution ARN conditions in policies directly impacts security posture.
Diff
diff --git a/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-mediastore.md b/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-mediastore.md index b9557fdbb..0c47c85ea 100644 --- a//AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-mediastore.md +++ b//AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-mediastore.md @@ -28 +28 @@ Complete the steps described in the following topics to set up a new origin acce - * Giving the origin access control permission to access the MediaStore origin + * Grant CloudFront permission to access the MediaStore origin @@ -39 +39 @@ Before you create and set up origin access control, you must have a CloudFront d -### Giving the origin access control permission to access the MediaStore origin +### Grant CloudFront permission to access the MediaStore origin @@ -41 +41 @@ Before you create and set up origin access control, you must have a CloudFront d -Before you create an origin access control or set it up in a CloudFront distribution, make sure the OAC has permission to access the MediaStore origin. Do this after creating a CloudFront distribution, but before adding the OAC to the MediaStore origin in the distribution configuration. +Before you create an origin access control or set it up in a CloudFront distribution, make sure that CloudFront has permission to access the MediaStore origin. Do this after creating a CloudFront distribution, but before adding the OAC to the MediaStore origin in the distribution configuration. @@ -43 +43 @@ Before you create an origin access control or set it up in a CloudFront distribu -To give the OAC permission to access the MediaStore origin, use a MediaStore container policy to allow the CloudFront service principal (`cloudfront.amazonaws.com`) to access the origin. Use a `Condition` element in the policy to allow CloudFront to access the MediaStore container only when the request is on behalf of the CloudFront distribution that contains the MediaStore origin. +Use a MediaStore container policy to allow the CloudFront service principal (`cloudfront.amazonaws.com`) to access the origin. Use a `Condition` element in the policy to allow CloudFront to access the MediaStore container only when the request is on behalf of the CloudFront distribution that contains the MediaStore origin. This is the distribution with the MediaStore origin that you want to add OAC to. @@ -45 +45 @@ To give the OAC permission to access the MediaStore origin, use a MediaStore con -The following are examples of MediaStore container policies that allow a CloudFront OAC to access a MediaStore origin. +The following are examples of MediaStore container policies that allow a CloudFront distribution to access a MediaStore origin. @@ -47 +47 @@ The following are examples of MediaStore container policies that allow a CloudFr -###### Example MediaStore container policy that allows read-only access to a CloudFront OAC +###### Example MediaStore container policy that allows read-only access for a CloudFront distribution with OAC enabled @@ -75 +75 @@ The following are examples of MediaStore container policies that allow a CloudFr -###### Example MediaStore container policy that allows read and write access to a CloudFront OAC +###### Example MediaStore container policy that allows read and write access for a CloudFront distribution with OAC enabled