JA EN
shiichan

Say Goodbye to Custom Signing Lambdas — CloudFront Can Now Natively Secure S3 MRAP!

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hey everyone, it's Shiichan! Here's a nice little simplification for global content delivery setups, let's check it out!

AWS What's New aws.amazon.com

What was announced?

This comes from AWS What's New. Amazon CloudFront's Origin Access Control (OAC) now supports Amazon S3 Multi-Region Access Points (MRAP), so you can protect your MRAP origin and only allow access from designated CloudFront distributions.

Pairing CloudFront with S3 MRAP lets you serve content from a single global endpoint that automatically routes to the closest available replicated bucket on a cache miss, balancing performance and resilience for globally distributed users.

The story so far

Previously, accessing an S3 MRAP origin from CloudFront meant computing and forwarding your own Asymmetric Signature Version 4 (SigV4a) Authorization header, typically through a custom Lambda@Edge function. It worked, but building and maintaining that signing logic yourself was extra overhead.

What changes

CloudFront now natively signs requests to S3 MRAP origins, so that custom Lambda@Edge function is no longer necessary.

  • No more custom Authorization header computation
  • Your MRAP origin can be OAC-secured, accessible only from designated distributions
  • Cache-miss fills from the nearest region stay fast

For teams running global delivery setups, this simplifies the architecture while also tightening security.

Dive Deep

This is available worldwide, except in the CloudFront China Region, at no additional cost. You can enable OAC when configuring your S3 MRAP endpoint through the CloudFront Console, SDK, CLI, or CloudFormation. If you already have a signing Lambda@Edge function in place, you should be able to retire it and switch to OAC instead.

Wrap-up

  • CloudFront OAC now supports S3 Multi-Region Access Points
  • No more need for a custom Lambda@Edge function doing SigV4a signing
  • MRAP origins can be OAC-secured, restricted to designated distributions
  • Available worldwide except CloudFront China, at no extra cost

If your team has been maintaining a custom signing Lambda@Edge, this is a great excuse to simplify!

Related posts