The Problem
You host a static website in S3 behind CloudFront. Security policy requires all website traffic to be inspected by AWS WAF. If someone can bypass CloudFront and hit S3 directly, WAF never sees the request.
The Solution
Use an Origin Access Identity (OAI) to lock S3 down so only CloudFront can reach it, and attach WAF to the CloudFront distribution to inspect every incoming request at the edge.
How It Works
The Architecture
1
2
3
User → CloudFront (WAF inspects) → S3 (OAI-restricted)
↑
└─ WAF blocks bad requests before they hit S3
Step 1: Create an OAI
1
2
3
aws cloudfront create-cloud-front-origin-access-identity \
--cloud-front-origin-access-identity-config \
CallerReference=static-site,Comment="OAI for static-site"
Note the returned Id — that becomes the OAI principal in the bucket policy.
Step 2: Bucket Policy That Only Allows the OAI
1
2
3
4
5
6
7
8
9
10
11
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1XXXXXXXXXXXX"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-static-site/*"
}]
}
Now direct S3 URLs return 403 Forbidden. Only CloudFront requests succeed.
Step 3: Attach a WAF Web ACL to CloudFront
1
2
3
aws wafv2 associate-web-acl \
--web-acl-arn arn:aws:wafv2:us-east-1:123456789012:global/webacl/site-acl/... \
--resource-arn arn:aws:cloudfront::123456789012:distribution/E2XXXXXXXXXXXX
WAF now inspects every request — blocking SQL injection, XSS, geo-restricted traffic, or whatever your rules dictate.
OAI vs OAC — Which to Use
AWS now recommends Origin Access Control (OAC) over OAI for new distributions. OAC supports SSE-KMS-encrypted S3 origins and uses SigV4 signing. If your bucket is encrypted with a customer-managed KMS key, you must use OAC.
Why Not the Alternatives?
Bucket policy allowing WAF’s ARN — WAF has no ARN that can be an S3 principal. WAF is an inline inspector, not an access identity.
CloudFront forwarding to WAF — WAF is not a forwarding destination. It attaches to a distribution and inspects inline at the edge.
Security group for CloudFront IPs — S3 is not a VPC service. Security groups do not apply.
Key Takeaways
- OAI (or OAC) blocks direct S3 access — only CloudFront requests succeed
- WAF on the CloudFront distribution inspects every request at the edge
- Use OAC for new distributions — required for SSE-KMS buckets
- WAF rules run before requests reach your origin, so blocked requests never touch S3
- S3 access controls are policy-based (bucket policies, IAM) — not network-based (no security groups)
Never miss a story from us, subscribe to our newsletter