Amazon CloudFront Enables Origin Access Control for S3 Multi-Region Access Points

CloudFront now natively authenticates requests to S3 MRAP origins, improving security and simplifying architecture.

By Nina Foster · Editorial pseudonym · 2026-08-20 · 1 min read

AI-ASSISTED REPORTING · RETROSPECTIVE ARCHIVE

Retrospective edition: 2026-08-20. Source published: 2026-08-20. Added to this archive: 2026-11-03. This briefing was prepared later from the linked announcement; it was not published on this website on the historical edition date.

AWS introduced support for Origin Access Control on CloudFront distributions accessing Amazon S3 Multi-Region Access Points. This allows customers to restrict S3 MRAP bucket access exclusively to designated CloudFront distributions, enhancing origin security and streamlining content delivery with a single global endpoint that routes requests to nearest replicated buckets.

Previously, customers had to implement custom authorization header signing via Lambda@Edge functions. Now, CloudFront automatically signs requests to S3 MRAP origins using OAC, reducing operational complexity and improving performance by accelerating cache-miss fills. This feature is broadly available except for the China CloudFront region, with no additional fees beyond standard CloudFront usage.

Source & further reading

Amazon CloudFront now supports Origin Access Control (OAC) for Amazon S3 Multi-Region Access Points ↗

Source published 2026-08-20. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.