S3 CORS configuration warrants a CloudFront delivery review

What it checks

S3 CORS configuration warrants a CloudFront delivery review

Where it applies

Terraform: aws_s3_bucket_cors_configuration

CloudFormation: AWS::S3::Bucket

How to fix it

1. If no distribution already serves this bucket, review CloudFront for cacheable downloads. Preserve CORS methods and forward required request headers; uploads do not establish a caching saving, and regular S3 charges remain.
2. Identify {bucket_owner} before editing. For a REST origin, configure OAC and merge least-privilege bucket-policy permissions scoped to the distribution AWS:SourceArn; add KMS key policy permissions for SSE-KMS. Grant only intended write actions and object paths. For an actual website endpoint use a custom origin, which does not support OAC.

Frameworks

• AWS Well-Architected PERF.4

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules