feat(cloudfront): add support for S3 Multi-Region Access Point origins with OAC

[piotrekwitkowski]

Describe the feature

Support Amazon S3 Multi-Region Access Points (MRAP) as a CloudFront origin protected by Origin Access Control.

Use Case

CloudFront natively signs requests to S3 MRAP origins as of 2026-08-20. Per the developer guide, the required OAC config is the existing s3 origin type with the sigv4a signing protocol:

OriginAccessControlOriginType: s3
SigningBehavior: always
SigningProtocol: sigv4a

CDK cannot express this. SigningProtocol (packages/aws-cdk-lib/aws-cloudfront/lib/origin-access-control.ts:135) has one member:

export enum SigningProtocol {
  SIGV4 = 'sigv4',
}

and all three Signing statics (:149, :155, :160) are built on it. No new OriginAccessControlOriginType is needed.

Proposed Solution

1. Add SIGV4A to SigningProtocol and a matching Signing static, usable with the existing S3OriginAccessControl.
2. Add S3MrapOrigin to aws-cloudfront-origins, taking the MRAP alias and deriving the origin domain. Leaving a withOriginAccessControl() grant helper out for now, since there is no MRAP L2 to write the policies on.

Origin configuration

An MRAP origin is a custom origin with originAccessControlId set — not S3OriginConfig. Per the S3 user guide: "To use Multi-Region Access Points with Amazon CloudFront, you must configure the Multi-Region Access Point as a Custom Origin distribution type." Note that OriginAccessControlOriginType: s3 does not imply S3OriginConfig — CDK's FunctionUrlOrigin already pairs a lambda-type OAC with a CustomOriginConfig.

S3MrapOrigin should therefore extend HttpOrigin, following S3StaticWebsiteOrigin, which is likewise an S3-branded custom origin deriving its domain from its input. HttpOrigin already defaults protocolPolicy to HTTPS_ONLY, so no override is needed.

Dependency

The AWS::CloudFront::OriginAccessControl schema currently constrains SigningProtocol to ^(sigv4)$, so a sigv4a OAC would synthesize but fail at deploy. Once it lands in CloudFormation, step 1 is additive and small.

Workaround

originAccessControlId is on OriginOptions, which HttpOriginProps extends:

const oac = new cloudfront.S3OriginAccessControl(this, 'Oac');
const origin = new origins.HttpOrigin('<alias>.accesspoint.s3-global.amazonaws.com', {
  originAccessControlId: oac.originAccessControlId,
});

Subject to the same CloudFormation constraint, with policies written by hand.

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS CDK Library version

main (2e6b561e28)

AWS CDK CLI version

N/A

Environment details

macOS 26.5.1

[pahud]

This is a good feature request, and I found no duplicate. I reproduced the current gap with installed aws-cdk-lib 2.263.0: SigningProtocol exposes only SIGV4. Supplying sigv4a through the public Signing constructor still synthesized the correct S3 OAC and HTTPS custom origin, although the bundled CloudFormation validator emitted a stale ^(sigv4)$ warning.

The current L2 limitation is here:

aws-cdk/packages/aws-cdk-lib/aws-cloudfront/lib/origin-access-control.ts

Lines 132 to 175 in 51234fd

	/**
	* The signing protocol of the Origin Access Control.
	*/
	export enum SigningProtocol {
	/**
	* The AWS Signature Version 4 signing protocol.
	*/
	SIGV4 = 'sigv4',
	}
	/**
	* Options for how CloudFront signs requests.
	*/
	export class Signing {
	/**
	* Sign all origin requests using the AWS Signature Version 4 signing protocol.
	*/
	public static readonly SIGV4_ALWAYS = new Signing(SigningProtocol.SIGV4, SigningBehavior.ALWAYS);
	/**
	* Sign only if the viewer request doesn't contain the Authorization header
	* using the AWS Signature Version 4 signing protocol.
	*/
	public static readonly SIGV4_NO_OVERRIDE = new Signing(SigningProtocol.SIGV4, SigningBehavior.NO_OVERRIDE);
	/**
	* Do not sign any origin requests.
	*/
	public static readonly NEVER = new Signing(SigningProtocol.SIGV4, SigningBehavior.NEVER);
	/**
	* The signing protocol
	*/
	public readonly protocol: SigningProtocol;
	/**
	* Which requests CloudFront signs.
	*/
	public readonly behavior: SigningBehavior;
	public constructor(protocol: SigningProtocol, behavior: SigningBehavior) {
	this.protocol = protocol;
	this.behavior = behavior;
	}

As an immediate workaround, try the generated CfnOriginAccessControlPropsMixin first to set originAccessControlConfig.signingProtocol to sigv4a on S3OriginAccessControl, then use HttpOrigin with the MRAP alias and originAccessControlId. This avoids a raw L1 override and preserves the existing L2 defaults. The mixin package version should match aws-cdk-lib.

HttpOrigin already generates the required HTTPS custom-origin shape:

aws-cdk/packages/aws-cdk-lib/aws-cloudfront-origins/lib/http-origin.ts

Lines 8 to 98 in 51234fd

	* Properties for an Origin backed by an S3 website-configured bucket, load balancer, or custom HTTP server.
	*/
	export interface HttpOriginProps extends cloudfront.OriginProps {
	/**
	* Specifies the protocol (HTTP or HTTPS) that CloudFront uses to connect to the origin.
	*
	* @default OriginProtocolPolicy.HTTPS_ONLY
	*/
	readonly protocolPolicy?: cloudfront.OriginProtocolPolicy;
	/**
	* The SSL versions to use when interacting with the origin.
	*
	* @default OriginSslPolicy.TLS_V1_2
	*/
	readonly originSslProtocols?: cloudfront.OriginSslPolicy[];
	/**
	* The HTTP port that CloudFront uses to connect to the origin.
	*
	* @default 80
	*/
	readonly httpPort?: number;
	/**
	* The HTTPS port that CloudFront uses to connect to the origin.
	*
	* @default 443
	*/
	readonly httpsPort?: number;
	/**
	* Specifies how long, in seconds, CloudFront waits for a response from the origin, also known as the origin response timeout.
	* The minimum is 1 second. The maximum is governed by the origin response timeout quota, which is
	* adjustable, so the effective maximum depends on the target account.
	*
	* The default quota allows up to 120 seconds; higher values require an approved limit increase
	* in the target account, and otherwise produce an error at deploy time.
	*
	* @default Duration.seconds(30)
	*/
	readonly readTimeout?: cdk.Duration;
	/**
	* Specifies how long, in seconds, CloudFront persists its connection to the origin.
	* The minimum is 1 second. The maximum is governed by the keep-alive timeout per origin quota,
	* which is adjustable, so the effective maximum depends on the target account.
	*
	* The default quota allows up to 300 seconds; higher values require an approved limit increase
	* in the target account, and otherwise produce an error at deploy time.
	*
	* @default Duration.seconds(5)
	*/
	readonly keepaliveTimeout?: cdk.Duration;
	/**
	* Specifies which IP protocol CloudFront uses when connecting to your origin.
	*
	* If your origin uses both IPv4 and IPv6 protocols, you can choose dualstack to help optimize reliability.
	*
	* @default undefined - AWS Cloudfront default is IPv4
	*/
	readonly ipAddressType?: cloudfront.OriginIpAddressType;
	}
	/**
	* An Origin for an HTTP server or S3 bucket configured for website hosting.
	*/
	export class HttpOrigin extends cloudfront.OriginBase {
	constructor(domainName: string, private readonly props: HttpOriginProps = {}) {
	super(domainName, props);
	validateMinimumSeconds('readTimeout', 1, props.readTimeout);
	validateMinimumSeconds('keepaliveTimeout', 1, props.keepaliveTimeout);
	this.validateResponseCompletionTimeoutWithReadTimeout(props.responseCompletionTimeout, props.readTimeout);
	this.validatePortNumber('httpPort', props.httpPort);
	this.validatePortNumber('httpsPort', props.httpsPort);
	}
	protected renderCustomOriginConfig(): cloudfront.CfnDistribution.CustomOriginConfigProperty | undefined {
	return {
	originSslProtocols: this.props.originSslProtocols ?? [cloudfront.OriginSslPolicy.TLS_V1_2],
	originProtocolPolicy: this.props.protocolPolicy ?? cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
	httpPort: this.props.httpPort,
	httpsPort: this.props.httpsPort,
	originReadTimeout: this.props.readTimeout?.toSeconds(),
	originKeepaliveTimeout: this.props.keepaliveTimeout?.toSeconds(),
	ipAddressType: this.props.ipAddressType,
	};
	}

PR #38629 looks like the right focused contribution for the type-safe signing support, and its deployed integration test is useful evidence that the CloudFormation backend accepts sigv4a despite the lagging public schema. It is currently behind main and awaiting review:

aws-cdk/packages/aws-cdk-lib/aws-cloudfront/lib/origin-access-control.ts

Lines 135 to 174 in be22180

	export enum SigningProtocol {
	/**
	* The AWS Signature Version 4 signing protocol.
	*/
	SIGV4 = 'sigv4',
	/**
	* The AWS Signature Version 4A signing protocol.
	*
	* Signs requests for multiple AWS Regions, as needed by origins such as
	* Amazon S3 Multi-Region Access Points.
	*
	* @see https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html
	*/
	SIGV4A = 'sigv4a',
	}
	/**
	* Options for how CloudFront signs requests.
	*/
	export class Signing {
	/**
	* Sign all origin requests using the AWS Signature Version 4 signing protocol.
	*/
	public static readonly SIGV4_ALWAYS = new Signing(SigningProtocol.SIGV4, SigningBehavior.ALWAYS);
	/**
	* Sign only if the viewer request doesn't contain the Authorization header
	* using the AWS Signature Version 4 signing protocol.
	*/
	public static readonly SIGV4_NO_OVERRIDE = new Signing(SigningProtocol.SIGV4, SigningBehavior.NO_OVERRIDE);
	/**
	* Sign all origin requests using the AWS Signature Version 4A signing protocol.
	*/
	public static readonly SIGV4A_ALWAYS = new Signing(SigningProtocol.SIGV4A, SigningBehavior.ALWAYS);
	/**
	* Do not sign any origin requests.
	*/
	public static readonly NEVER = new Signing(SigningProtocol.SIGV4, SigningBehavior.NEVER);

One scope note: #38629 intentionally does not add S3MrapOrigin, so I would keep this issue open for that convenience L2 or split the remaining work into a follow-up issue before closing this one. Contributions for that follow-up are welcome. The CloudFormation validation schema should also be updated so native support does not continue to produce the stale sigv4-only warning.

[piotrekwitkowski]

Thanks for the review.

On scope, agreed. I’ll keep this issue open for S3MrapOrigin, while #38629 remains focused on native, type-safe sigv4a support.

Thanks also for the property-mixin pointer. CfnOriginAccessControlPropsMixin is available from @aws-cdk/cfn-property-mixins/aws-cloudfront. Its default combine strategy deep-merges the configuration, so it can override only signingProtocol. Together with HttpOrigin, this provides a current cross-language workaround.

The live CloudFormation schema now includes sigv4a. The remaining sigv4-only validation warning comes from the older offline schema bundled with @aws/cloudformation-validate 1.7.0. It is non-failing and does not affect deployment.

The mixin remains an escape hatch rather than a native, type-safe Signing API, particularly for jsii languages where the missing enum member cannot be supplied directly.

#38629 is now rebased onto main, and its integration test has deployed successfully in us-east-1.

[satyakigh]

Hello, this was fixed in aws-cloudformation/cloudformation-validate#364, can you please confirm whether this is still an issue with the latest cdk release?

[piotrekwitkowski]

It's not an issue anymore @satyakigh, thanks! I have updated the report in #38629: ad4b49e