Origin Access Identity Should Be Enabled For CloudFront Distributions

Using Console

Sure, here are the steps to remediate the misconfiguration “Origin Access Identity should be enabled for CloudFront distributions” in AWS using AWS console:

Log in to the AWS Management Console.
Navigate to the CloudFront service.
Select the distribution for which you want to enable Origin Access Identity.
Click on the “Behaviors” tab.
Select the behavior for which you want to enable Origin Access Identity.
Click on the “Edit” button.
In the “Origin Settings” section, select “Yes” for “Restrict Bucket Access”.
Select “Create a New Identity” under “Origin Access Identity”.
Provide a name for the new identity and click on the “Create” button.
Click on the “Yes, Edit” button to save the changes.

By following these steps, you have successfully enabled Origin Access Identity for the CloudFront distribution and remediated the misconfiguration.

Using CLI

To remediate this misconfiguration in AWS using AWS CLI, you can follow the below steps:

Open the AWS CLI on your local machine.
Run the following command to list all the CloudFront distributions in your AWS account:

aws cloudfront list-distributions

Identify the distribution for which the Origin Access Identity should be enabled.
Run the following command to update the distribution configuration and enable Origin Access Identity:

aws cloudfront update-distribution --id <distribution-id> --distribution-config '{"Comment":"", "Origins": {"Quantity":1,"Items":[{"Id":"<origin-id>","DomainName":"<origin-domain-name>","OriginPath":"","CustomHeaders":{"Quantity":0},"S3OriginConfig":{"OriginAccessIdentity":"<origin-access-identity>"},"CustomOriginConfig":{"HTTPPort":80,"HTTPSPort":443,"OriginProtocolPolicy":"http-only","OriginSslProtocols":{"Quantity":3,"Items":["TLSv1","TLSv1.1","TLSv1.2"]},"OriginReadTimeout":30,"OriginKeepaliveTimeout":5}}]},"Enabled":true,"PriceClass":"PriceClass_All","ViewerCertificate":{"CloudFrontDefaultCertificate":true,"MinimumProtocolVersion":"TLSv1","CertificateSource":"cloudfront"},"DefaultRootObject":"","Logging":{"Enabled":false,"IncludeCookies":false,"Bucket":"","Prefix":""},"WebACLId":"","HttpVersion":"http2","IsIPV6Enabled":true}'

Replace the following placeholders with actual values:

<distribution-id>: The ID of the CloudFront distribution.
<origin-id>: The ID of the origin for which Origin Access Identity should be enabled.
<origin-domain-name>: The domain name of the origin for which Origin Access Identity should be enabled.
<origin-access-identity>: The ARN of the Origin Access Identity that should be associated with the origin.

After running the command, the CloudFront distribution configuration will be updated, and Origin Access Identity will be enabled for the specified origin.

Note: Make sure you have the necessary permissions to update the CloudFront distribution configuration.

Using Python

To remediate the misconfiguration “Origin Access Identity should be enabled for CloudFront distributions” in AWS using Python, follow the below steps:

Import the required libraries:

import boto3

Create a CloudFront client:

client = boto3.client('cloudfront')

Get the list of all distributions:

response = client.list_distributions()

Loop through the distributions and check if Origin Access Identity is enabled:

for distribution in response['DistributionList']['Items']:
    if distribution['Enabled'] and not distribution['Origins']['Items'][0]['S3OriginConfig']['OriginAccessIdentity']:
        print(f"Disabling distribution {distribution['Id']}...")
        client.update_distribution(
            DistributionConfig={
                'Id': distribution['Id'],
                'CallerReference': distribution['CallerReference'],
                'Comment': distribution['Comment'],
                'DefaultCacheBehavior': distribution['DefaultCacheBehavior'],
                'Origins': {
                    'Quantity': len(distribution['Origins']['Items']),
                    'Items': [
                        {
                            'Id': distribution['Origins']['Items'][0]['Id'],
                            'DomainName': distribution['Origins']['Items'][0]['DomainName'],
                            'S3OriginConfig': {
                                'OriginAccessIdentity': 'origin-access-identity/cloudfront/XXXXXXXXXXXX'
                            }
                        }
                    ]
                },
                'Enabled': True
            },
            IfMatch=distribution['ETag']
        )

Replace 'origin-access-identity/cloudfront/XXXXXXXXXXXX' with the actual Origin Access Identity that you want to use.
Run the Python script to remediate the misconfiguration.

With these steps, you can remediate the misconfiguration “Origin Access Identity should be enabled for CloudFront distributions” in AWS using Python.

Using Terraform

# CloudFront Origin Access Control (OAC) for S3 origin
resource "aws_cloudfront_origin_access_control" "S3_OAC" {
  name                              = "oac-for-${aws_cloudfront_distribution.CLOUDFRONT_DISTRIBUTION.id}" # adjust if needed
  description                       = "OAC for distribution ${aws_cloudfront_distribution.CLOUDFRONT_DISTRIBUTION.id}"
  signing_protocol                  = "sigv4"
  signing_behavior                  = "always"
  origin_access_control_origin_type = "s3"
}

# CloudFront distribution with S3 origin using the OAC
resource "aws_cloudfront_distribution" "CLOUDFRONT_DISTRIBUTION" {
  # ... other required arguments (enabled, default_cache_behavior, etc.)

  origin {
    domain_name = aws_s3_bucket.S3_ORIGIN_BUCKET.bucket_regional_domain_name
    origin_id   = "S3-${aws_s3_bucket.S3_ORIGIN_BUCKET.id}"

    s3_origin_config {
      origin_access_identity = null # ensure OAI is not used (legacy)
    }

    origin_access_control_id = aws_cloudfront_origin_access_control.S3_OAC.id
  }

  # ... rest of the distribution config
}

# S3 bucket used as the CloudFront origin
resource "aws_s3_bucket" "S3_ORIGIN_BUCKET" {
  bucket = "S3_ORIGIN_BUCKET_NAME" # replace with your S3 origin bucket name
}

# Bucket policy granting CloudFront access via service principal + SourceArn condition
resource "aws_s3_bucket_policy" "S3_ORIGIN_BUCKET_POLICY" {
  bucket = aws_s3_bucket.S3_ORIGIN_BUCKET.id

  # WARNING: This policy document REPLACES any existing bucket policy on this bucket.
  # If you already have a policy, merge its statements into this document before applying.
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "AllowCloudFrontServicePrincipal"
        Effect = "Allow"
        Principal = {
          Service = "cloudfront.amazonaws.com"
        }
        Action   = "s3:GetObject"
        Resource = "arn:aws:s3:::${aws_s3_bucket.S3_ORIGIN_BUCKET.bucket}/*"
        Condition = {
          StringEquals = {
            "AWS:SourceArn" = aws_cloudfront_distribution.CLOUDFRONT_DISTRIBUTION.arn
          }
        }
      }
    ]
  })
}

Substitute:

S3_ORIGIN_BUCKET_NAME with your S3 origin bucket name.
Add all other required arguments to aws_cloudfront_distribution.CLOUDFRONT_DISTRIBUTION (commented as “…”).

This change updates the CloudFront distribution in place (it does not force resource replacement) but will trigger a distribution update that must propagate to edge locations.For verification, terraform plan should show:

A new aws_cloudfront_origin_access_control resource.
An in-place update to aws_cloudfront_distribution adding origin_access_control_id and removing any OAI usage.
A create or update of aws_s3_bucket_policy with a statement allowing cloudfront.amazonaws.com with the AWS:SourceArn condition referencing the distribution ARN.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Origin Access Identity Should Be Enabled For CloudFront Distributions

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: