Check ID: cloudfront_distributions_s3_origin_non_existent_bucket
Provider: AWS
Service: cloudfront
Severity: HIGH
Categories: resilience
Resource type: AwsCloudFrontDistribution

​
What this check verifies

CloudFront distributions with S3OriginConfig should reference existing S3 bucket origins (excluding static website hosting). Identifies origins where the configured bucket name does not exist.

​
Risk

Dangling S3 origins allow potential bucket takeover: an attacker could create the missing bucket and have CloudFront retrieve attacker-controlled objects if access isn’t restricted. This threatens integrity (content spoofing, cache poisoning) and availability (errors/timeouts), undermining user trust.

​
Recommendation

Ensure origins reference valid, owned buckets; delete or update stale references. Enforce origin access control (or OAI) and tight bucket policies so only the distribution can access objects. Apply least privilege, manage bucket names, and monitor origin health to prevent misrouting.

​
Remediation

# Ensure the S3 bucket referenced by the CloudFront S3 origin exists
resource "aws_s3_bucket" "<example_resource_name>" {
  bucket = "<example_resource_name>"  # Critical: must exactly match the bucket name used in the CloudFront origin's domain (before ".s3")
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudfront_distributions_s3_origin_non_existent_bucket. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks