AWS securityhub medium security documentation change

Service: securityhub · 2026-01-10 · Security-related medium

File: securityhub/latest/userguide/cloudfront-controls.md

Summary

Added new security control [CloudFront.17] requiring trusted key groups for signed URLs/cookies

Security assessment

Mitigates security risks from using root account keys by promoting key groups. Control specifically addresses authentication weaknesses in signed URL implementations.

Diff

diff --git a/securityhub/latest/userguide/cloudfront-controls.md b/securityhub/latest/userguide/cloudfront-controls.md
index fcc2c5b4c..a9ad48912 100644
--- a//securityhub/latest/userguide/cloudfront-controls.md
+++ b//securityhub/latest/userguide/cloudfront-controls.md
@@ -5 +5 @@
-[CloudFront.1] CloudFront distributions should have a default root object configured[CloudFront.3] CloudFront distributions should require encryption in transit[CloudFront.4] CloudFront distributions should have origin failover configured[CloudFront.5] CloudFront distributions should have logging enabled[CloudFront.6] CloudFront distributions should have WAF enabled[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins[CloudFront.13] CloudFront distributions should use origin access control[CloudFront.14] CloudFront distributions should be tagged[CloudFront.15] CloudFront distributions should use the recommended TLS security policy[CloudFront.16] CloudFront distributions should use origin access control for Lambda function URL origins
+[CloudFront.1] CloudFront distributions should have a default root object configured[CloudFront.3] CloudFront distributions should require encryption in transit[CloudFront.4] CloudFront distributions should have origin failover configured[CloudFront.5] CloudFront distributions should have logging enabled[CloudFront.6] CloudFront distributions should have WAF enabled[CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates[CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests[CloudFront.9] CloudFront distributions should encrypt traffic to custom origins[CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins[CloudFront.12] CloudFront distributions should not point to non-existent S3 origins[CloudFront.13] CloudFront distributions should use origin access control[CloudFront.14] CloudFront distributions should be tagged[CloudFront.15] CloudFront distributions should use the recommended TLS security policy[CloudFront.16] CloudFront distributions should use origin access control for Lambda function URL origins[CloudFront.17] CloudFront distributions should use trusted key groups for signed URLs and cookies
@@ -350,0 +351,26 @@ For information about configuring OAC for an Amazon CloudFront distribution that
+## [CloudFront.17] CloudFront distributions should use trusted key groups for signed URLs and cookies
+
+**Category:** Protect > Secure access management > Access control
+
+**Severity:** Medium
+
+**Resource type:** `AWS::CloudFront::Distribution`
+
+**AWS Config rule:** `cloudfront-distribution-key-group-enabled`
+
+**Schedule type:** Change triggered
+
+**Parameters:** None
+
+This control checks whether an Amazon CloudFront distribution is configured to use trusted key groups for signed URL or signed cookie authentication. The control fails if the CloudFront distribution uses trusted signers, or if the distribution has no authentication configured.
+
+To use signed URLs or signed cookies, you need a signer. A signer is either a trusted key group that you create in CloudFront, or an AWS account that contains a CloudFront key pair. We recommend that you use trusted key groups because with CloudFront key groups, you don't need to use the AWS account root user to manage the public keys for CloudFront signed URLs and signed cookies.
+
+###### Note
+
+This control does not evaluate multi-tenant CloudFront distributions `(connectionMode=tenant-only)`.
+
+### Remediation
+
+For information about using trusted key groups with signed URLs and cookies, see [Using trusted key groups](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) in the _Amazon CloudFront Developer Guide_.
+