Previously, customers relied on custom methods such as secret headers or IP allow-lists to verify CloudFront-origin requests, incurring ongoing maintenance overhead. The new mTLS support uses certificate-based authentication with client certificates issued by AWS Private Certificate Authority or imported third-party CAs.
This feature provides standardized security for AWS, on-premises, and third-party origins, eliminating the need for custom authentication logic and improving protection of backend infrastructure. No additional charges apply, and configuration options cover multiple AWS services. Independent operational impact assessments are pending.
Source & further reading
Amazon CloudFront announces mutual TLS support for origins ↗Source published 2026-02-02. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.