Hi, everyone, and welcome back.
Now, in today's video, we are going to discuss about the origin access identity in cloud front.
Now, one of the challenges that you will see in a cloud based architecture is that the security measures
that you apply at a cloud level can easily be bypassed if an attacker is sending the query directly
to the origin.
For example, you're at the cloud front level.
You have applied certain geo restriction filter which blocks the request from a country A and it blocks
the request from country B, So if a user from a country A or B sends a request to the Cloud friend,
this request will automatically be blocked.
Now what this attacker can do is that instead of sending the request to the cloud front, because the
attacker knows that you have a cloud for distribution and there must be an origin to which the cloud
friend must be sending the request to.
So instead of sending the request to the cloud front, the attacker decides to directly send a request
to the origin, which is the S3 bucket.
And since the request is being sent directly to the S3 bucket, all of the restrictions that you applied
cloud front level will easily be bypassed.
And this is something that you do not really want in production environments.
So in order to overcome this, you can make use of a feature called as the cloud print, origin, access
identity, and it ensures that the S3 bucket that you have only receives the request from cloud front
in case if attacker tries to directly send a request to the S3 bucket, that request will be denied.
So in the bucket also you have a policy which states only allow the connections from cloud from distribution
with a specific ID of the distribution that you have in your environment.
So that's the high level overview.
Let's jump into the quick demo to understand this in a better terms.
Now for today's demo, I have a cloud distribution that is available, and this distribution in turn
is associated with the origin of S3 Bucket.
The name of the bucket is CFPB's assets Bucket.
This is very similar here.
CPU labs assets bucket.
Now similar to how we had seen on very specific bucket policies associated at the S3 level.
Let us also quickly look into it.
So if I go to permissions, let's go a bit down here.
You see that there is a specific bucket policy.
In fact, let me zoom in what this specific bucket policy does.
It allows requests from the cloud front service.
So if it is allowed from the service of cloud and the action is get object and you have the bucket in
here and within here you have a condition which states that the source must be this.
And what does this mean?
You have the idea of the cloud for distribution.
So it ends with v v un.
If you look into the cloud distribution id again, it ends with v v un.
So irrespective of how many cloud distributions you have in an account, that does not matter.
Only the cloud run distribution which matches this specific ID will be allowed to send the get object
request to the S3 bucket.
All right, so this is a very high level overview about the Origin Access identity.
Again, a simple feature, but this is very useful for production environments.
So with this will conclude today's video.