AWS AmazonCloudFront medium security documentation change
Summary
Updated CloudFront distribution creation steps to use automated OAC setup and simplified configuration flow. Removed manual S3 bucket policy update steps and added security protections page for WAF.
Security assessment
The change automates Origin Access Control (OAC) setup and S3 bucket policy updates, reducing manual configuration errors that could lead to bucket exposure. Explicitly mentions enabling AWS WAF security protections. Removes outdated guidance about default S3 bucket permissions, indicating improved secure defaults.
Diff
diff --git a/AmazonCloudFront/latest/DeveloperGuide/GettingStarted.SimpleDistribution.md b/AmazonCloudFront/latest/DeveloperGuide/GettingStarted.SimpleDistribution.md index a5ebe5145..870696dd9 100644 --- a//AmazonCloudFront/latest/DeveloperGuide/GettingStarted.SimpleDistribution.md +++ b//AmazonCloudFront/latest/DeveloperGuide/GettingStarted.SimpleDistribution.md @@ -7 +7 @@ PrerequisitesCreate bucketUpload contentCreate distributionAccess the contentCle -# Get started with a basic CloudFront distribution +# Get started with a CloudFront standard distribution @@ -9 +9 @@ PrerequisitesCreate bucketUpload contentCreate distributionAccess the contentCle -The procedures in this section show you how to use CloudFront to set up a basic configuration that does the following: +The procedures in this section show you how to use CloudFront to set up a standard distribution that does the following: @@ -11 +11 @@ The procedures in this section show you how to use CloudFront to set up a basic - * Creates a bucket to use as your distribution origin. + * Creates an S3 bucket to use as your distribution origin. @@ -24 +24 @@ The procedures in this section show you how to use CloudFront to set up a basic -Most of these options are customizable. For information about how to customize your CloudFront distribution options, see [Create a distribution](./distribution-web-creating-console.html). +Most of this is configured automatically for you when you create a CloudFront distribution. @@ -101 +101 @@ For this tutorial, you will create a CloudFront distribution that uses an Amazon - 3. For **Origin** , **Origin domain** , choose the S3 bucket that you created for this tutorial. + 3. Enter a **Distribution name** for the standard distribution. The name will appear as the value for the `Name` key as a tag. You can change this value later. You can add up to 50 tags for your standard distribution. For more information, see [Tag a distribution](./tagging.html). @@ -103 +103 @@ For this tutorial, you will create a CloudFront distribution that uses an Amazon - 4. For **Origin** , **Origin access** , select **Origin access control settings (recommended)**. + 4. Choose **Single website or app** , **Next**. @@ -105 +105 @@ For this tutorial, you will create a CloudFront distribution that uses an Amazon - 5. For **Origin access control** , choose **Create new OAC**. + 5. Choose **Next**. @@ -107 +107 @@ For this tutorial, you will create a CloudFront distribution that uses an Amazon - 6. In the **Create new OAC** pane, keep the default settings and choose **Create**. + 6. For **Origin type** page, select the **Amazon S3**. @@ -109 +109 @@ For this tutorial, you will create a CloudFront distribution that uses an Amazon - 7. For **Web Application Firewall (WAF)** , select one of the options. + 7. For **S3 origin** , choose **Browse S3** and select the S3 bucket that you created for this tutorial. @@ -111 +111 @@ For this tutorial, you will create a CloudFront distribution that uses an Amazon - 8. For all other sections and settings, accept the default values. For more information about these options, see [Distribution settings](./distribution-web-values-specify.html#DownloadDistValuesGeneral). + 8. For **Settings** , choose **Use recommended origin settings**. CloudFront will use the default recommended cache and origin settings for your Amazon S3 origin, including setting up Origin Access Control (OAC). For more information about the recommended settings, see [Preconfigured distribution settings reference](./template-preconfigured-origin-settings.html). @@ -113 +113 @@ For this tutorial, you will create a CloudFront distribution that uses an Amazon - 9. Choose **Create distribution**. + 9. Choose **Next**. @@ -115 +115 @@ For this tutorial, you will create a CloudFront distribution that uses an Amazon - 10. In **The S3 bucket policy needs to be updated** banner, read the message and choose **Copy policy**. + 10. On the **Enable security protections** page, choose whether to enable AWS WAF security protections. @@ -117 +117 @@ For this tutorial, you will create a CloudFront distribution that uses an Amazon - 11. In the same banner, choose the link to **Go to S3 bucket permissions to update policy**. (This takes you to your bucket detail page in the Amazon S3 console.) + 11. Choose **Next**. @@ -119 +119 @@ For this tutorial, you will create a CloudFront distribution that uses an Amazon - 12. For **Bucket policy** , choose **Edit**. + 12. Choose **Create distribution**. CloudFront updates the S3 bucket policy for you. @@ -121 +121 @@ For this tutorial, you will create a CloudFront distribution that uses an Amazon - 13. In the **Edit statement** field, paste the policy that you copied in step 10. + 13. Review the **Details** section for your new distribution. When your distribution is done deploying, the **Last modified** field changes from **Deploying** to a date and time. @@ -123,5 +123 @@ For this tutorial, you will create a CloudFront distribution that uses an Amazon - 14. Choose **Save changes**. - - 15. Return to the CloudFront console and review the **Details** section for your new distribution. When your distribution is done deploying, the **Last modified** field changes from **Deploying** to a date and time. - - 16. Record the domain name that CloudFront assigns to your distribution. It looks similar to the following: `d111111abcdef8.cloudfront.net`. + 14. Record the domain name that CloudFront assigns to your distribution. It looks similar to the following: `d111111abcdef8.cloudfront.net`. @@ -170,2 +165,0 @@ This Get started tutorial provides a minimal framework for creating a distributi - * By default, the files (objects) in the Amazon S3 bucket are set up as private. Only the AWS account that created the bucket has permission to read or write the files. If you want to allow anyone to access the files in your Amazon S3 bucket using CloudFront URLs, you must grant public read permissions to the objects. -