CloudFront - Blocking Access from Other Sites

Hi Dmytro, I hope everything is going well with you.

So far, I'm still having difficulties implementing the CORS rule. I'll detail what I've done so far in a test environment. Is there something I might be forgetting or doing incorrectly?

To test Cross-Origin Resource Sharing (CORS), I implemented the following steps in a test environment:

1 - I set up a new storage in Amazon S3, using the default creation settings.

2 - I established a new distribution on Amazon CloudFront.

3 - I restricted access to the S3 storage, allowing access only through CloudFront.

4 - In the CloudFront distribution, I accessed the "Behaviors" section and edited the default configuration "Default (*)".

5 - I created a new "Response headers policy".

6 - This new policy was configured with the following specifications: 6.1 - Name: AllowedList-CORS 6.2 - I accessed the "Cross-origin resource sharing (CORS)" section. 6.3 - I activated the "Configure CORS" option. 6.4 - I customized the "Access-Control-Allow-Origin" option to "https://domain-south.com" 6.5 - I customized the "Access-Control-Allow-Methods" option for GET, POST, and OPTIONS. 6.6 - I checked the "Origin override" option.

7 - Set up the policy named AllowedList-CORS in the "Response headers policy" section.

8 - To evaluate the loading of an MP3 file, I created an 'index.html' file that contains the following code. This file was hosted on 'https://domain-east.com/index.html'. The MP3 file loaded successfully. Continue below.

Note that I'm using fictional domains for illustration: I used 'https://domain-south.com' in the CORS configuration and 'https://domain-east.com/' for loading the MP3 file.

===

Could you assist me in configuring CORS?

Wishing you a Merry Christmas! Sincerely, Eduardo Sachs

Try add crossorigin="anonymous" in your webpage, e.g. <audio crossorigin="anonymous" controls>, everything else looks good

In fact, I have to do this on the CloudFront side, so that intruders can't use the files I have on CloudFront. You know?

It looks like you don't understand what is CORS and what kind of protection it provides. I gave you answer based on the initial request of how use CORS feature. But if you looking to protect your files behind CloudFront the proper solutions is https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-urls.html