--- title: Amazon CloudFront now supports Origin Access Control... description: CloudFront now natively supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points (MRAP), letting customers restrict MRAP origin access to... canonical: https://daily.dev/posts/amazon-cloudfront-now-supports-origin-access-control-oac-for-amazon-s3-multi-region-access-points-pcsddc0jg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Amazon CloudFront now supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points | daily.dev og:description: CloudFront now natively supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points (MRAP), letting customers restrict MRAP origin access to... og:url: https://daily.dev/posts/amazon-cloudfront-now-supports-origin-access-control-oac-for-amazon-s3-multi-region-access-points-pcsddc0jg og:image: https://api.daily.dev/og/posts/PcSdDc0jG.png og:image:alt: Amazon CloudFront now supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Amazon CloudFront now supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points **[AWS](https://daily.dev/sources/aws)** · 1 min read · 0 upvotes · 0 comments ## Summary CloudFront now natively supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points (MRAP), letting customers restrict MRAP origin access to designated CloudFront distributions without custom Lambda@Edge signing. Previously, developers had to manually compute and forward SigV4a authorization headers via a Lambda@Edge function; CloudFront now signs these requests natively, enabling faster cache-miss fills from the nearest region and OAC-secured access. The feature is available worldwide except CloudFront China, with no additional fees, and can be enabled via the Console, SDK, CLI, or CloudFormation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I secure a CloudFront distribution that uses an S3 Multi-Region Access Point as its origin? Use CloudFront's native Origin Access Control (OAC) support for S3 Multi-Region Access Points, which restricts origin access to designated CloudFront distributions. Configure it through the CloudFront Console, SDK, CLI, or CloudFormation when setting up the MRAP endpoint. This replaces the previous requirement of computing and forwarding a custom SigV4a Authorization header via a Lambda@Edge function. _Track infrastructure changes like CloudFront's MRAP security update on daily.dev before your next deployment._ ### Do I still need a Lambda@Edge function to sign requests to an S3 Multi-Region Access Point from CloudFront? No, a Lambda@Edge function is no longer required. CloudFront now natively signs Asymmetric Signature Version 4 (SigV4a) Authorization headers for requests to S3 MRAP origins, eliminating the need for custom signing code while also enabling OAC-based access restriction and faster cache-miss fills from the nearest region. _Engineers simplifying CDN-to-S3 signing logic can follow updates like this on daily.dev._ ## Similar posts on daily.dev - [Amazon CloudFront announces mutual TLS support for origins](https://daily.dev/posts/amazon-cloudfront-announces-mutual-tls-support-for-origins-mopgwqbws) · AWS · 0 upvotes · 0 comments - [CloudFront Adds Origin mTLS Authentication for End-to-End Zero Trust](https://daily.dev/posts/cloudfront-adds-origin-mtls-authentication-for-end-to-end-zero-trust-vb7apitcj) · InfoQ · 0 upvotes · 0 comments - [Amazon S3 Block Public Access now supports organization-level enforcement](https://daily.dev/posts/amazon-s3-block-public-access-now-supports-organization-level-enforcement-uzkedmjgr) · AWS · 0 upvotes · 0 comments - [Removing a Hidden Round Trip from a Multi-Region AWS API](https://daily.dev/posts/removing-a-hidden-round-trip-from-a-multi-region-aws-api-whlio3y4g) · InfoQ · 0 upvotes · 0 comments - [Introducing attribute-based access control for Amazon S3 general purpose buckets](https://daily.dev/posts/introducing-attribute-based-access-control-for-amazon-s3-general-purpose-buckets-5rdbbb8ga) · AWS · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#aws-s3](https://daily.dev/tags/aws-s3) [View this post on daily.dev](https://daily.dev/posts/amazon-cloudfront-now-supports-origin-access-control-oac-for-amazon-s3-multi-region-access-points-pcsddc0jg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Amazon CloudFront now supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points","url":"https://daily.dev/posts/amazon-cloudfront-now-supports-origin-access-control-oac-for-amazon-s3-multi-region-access-points-pcsddc0jg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/amazon-cloudfront-now-supports-origin-access-control-oac-for-amazon-s3-multi-region-access-points-pcsddc0jg"},"datePublished":"2026-08-20T20:51:23.223Z","dateModified":"2026-09-14T07:06:20.654Z","description":"CloudFront now natively supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points (MRAP), letting customers restrict MRAP origin access to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2587ee7271b19b73b7c9d67f739e4290?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2587ee7271b19b73b7c9d67f739e4290?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"AWS","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"AWS","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/aws","url":"https://daily.dev/sources/aws"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/amazon-cloudfront-now-supports-origin-access-control-oac-for-amazon-s3-multi-region-access-points-pcsddc0jg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,aws-s3","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"AWS","item":"https://daily.dev/sources/aws"},{"@type":"ListItem","position":3,"name":"Amazon CloudFront now supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/amazon-cloudfront-now-supports-origin-access-control-oac-for-amazon-s3-multi-region-access-points-pcsddc0jg#faq","mainEntity":[{"@type":"Question","name":"How do I secure a CloudFront distribution that uses an S3 Multi-Region Access Point as its origin?","acceptedAnswer":{"@type":"Answer","text":"Use CloudFront's native Origin Access Control (OAC) support for S3 Multi-Region Access Points, which restricts origin access to designated CloudFront distributions. Configure it through the CloudFront Console, SDK, CLI, or CloudFormation when setting up the MRAP endpoint. This replaces the previous requirement of computing and forwarding a custom SigV4a Authorization header via a Lambda@Edge function. Track infrastructure changes like CloudFront's MRAP security update on daily.dev before your next deployment."}},{"@type":"Question","name":"Do I still need a Lambda@Edge function to sign requests to an S3 Multi-Region Access Point from CloudFront?","acceptedAnswer":{"@type":"Answer","text":"No, a Lambda@Edge function is no longer required. CloudFront now natively signs Asymmetric Signature Version 4 (SigV4a) Authorization headers for requests to S3 MRAP origins, eliminating the need for custom signing code while also enabling OAC-based access restriction and faster cache-miss fills from the nearest region. Engineers simplifying CDN-to-S3 signing logic can follow updates like this on daily.dev."}}]} ```