A media company stored premium video content in a private Amazon S3 bucket. AWS CloudFront was configured to securely deliver videos using signed URLs. The architecture required that users access content exclusively through CloudFront while the S3 bucket remained inaccessible from the internet.
During a migration from Origin Access Identity (OAI) to Origin Access Control (OAC), an administrator updated the CloudFront distribution but forgot to remove a legacy S3 bucket policy that temporarily allowed public read access for testing. The CloudFront distribution continued functioning normally, so no operational issues were detected.
Several weeks later, a security audit revealed that search engines had indexed direct S3 object URLs. Anyone possessing the S3 object URL could download premium videos without CloudFront authentication or signed URLs. Since requests bypassed CloudFront entirely, download activity was invisible in CloudFront logs and access controls.
The security team immediately blocked public bucket access using S3 Block Public Access, replaced the bucket policy with an OAC-restricted policy, rotated signed URL keys, and requested removal of indexed URLs from search engines. CloudTrail and S3 server access logs were analyzed to determine the extent of unauthorized downloads.
Root Cause
- Misconfigured S3 bucket policy during OAI-to-OAC migration.
- Public bucket access left enabled after testing.
- Lack of continuous configuration compliance monitoring.
Business Impact
- Unauthorized access to premium digital content.
- Revenue loss due to content piracy.
- Increased legal and compliance efforts.
- Damage to brand reputation.
Lessons Learned
- Always enable S3 Block Public Access for private content.
- Prefer Origin Access Control (OAC) over legacy OAI for new deployments.
- Continuously monitor bucket policies using AWS Config and Amazon GuardDuty.
- Periodically audit CloudFront origins to ensure S3 objects cannot be accessed directly.
- Include storage access validation in every production deployment checklist.
