AWS First Steps
New feature

Amazon CloudFront now supports Origin Access Control for Amazon S3 Multi-Region Access Points

Amazon CloudFront adds Origin Access Control for S3 Multi-Region Access Points, enabling secure access without custom SigV4a headers

Starting today, Amazon CloudFront supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points (MRAP), allowing only designated CloudFront distributions to access origins. Previously, customers had to compute and forward Asymmetric Signature Version 4 (SigV4a) Authorization headers using custom Lambda@Edge functions. Now, CloudFront natively signs requests to S3 MRAP origins, providing faster cache-miss fills from the nearest region and secured MRAP access without custom header computation. This feature is available worldwide except in the China region, with no additional fees.

Why it matters

Developers and deployment managers seeking improved cache performance and security for globally distributed content delivery are the primary audience

Read the original AWS announcement

Related articles and terms

Amazon CloudFrontA CDN service that delivers content at high speed from edge locations around the worldHow CloudFront's 600+ PoPs Work - Anycast Routing and the Cache HierarchyLearn how CloudFront routes user requests to the nearest PoP using Anycast, the two-tier structure of edge locations and regional edge caches, and the design factors that determine cache hit rates.Monitoring Internet Performance with Amazon CloudWatch Internet Monitor - Visualizing Availability and LatencyLearn how Internet Monitor tracks application performance over the internet, analyzes availability by ISP, and detects health events.Global Network Acceleration - Low-Latency Delivery with AWS Global Accelerator and CloudFrontRoute traffic onto the AWS global network early using Anycast IPs to direct clients to the nearest edge location. This guide covers ALB/NLB integration and failover design.How AWS Signature Version 4 (SigV4) Works - The Cryptographic Mechanics of API AuthenticationA cryptographic deep dive into the 4-step SigV4 signing process (canonical request creation, string-to-sign construction, signing key derivation, signature calculation) used for AWS API authentication, plus an overview of SigV4A and presigned URLs.