Allowing MediaTailor Access Through CloudFront Function Security Rules (401 Errors)

The issue you're experiencing is due to your CloudFront Function blocking MediaTailor's requests because they don't include the expected Origin header or User-Agent values that your security rules require.

To solve this problem while maintaining security, you need to modify your CloudFront Function to specifically allow requests from MediaTailor's service. Here's how you can approach this:

1. Identify MediaTailor requests: AWS Elemental MediaTailor makes requests to your origin using its own service domain. You can identify these requests by checking for the MediaTailor service domain in the request headers.

2. Modify your CloudFront Function: Update your function to include an exception for MediaTailor by checking for its service identifier. For example:

function handler(event) {
var request = event.request;
var headers = request.headers;

// Check if the request is from MediaTailor
if (headers['user-agent'] && headers['user-agent'].value.includes('mediatailor.amazonaws.com')) {
// Allow MediaTailor requests
return request;
}

// Your existing security checks for other clients
if (!headers['origin'] || !headers['user-agent']) {
return {
statusCode: 401,
statusDescription: 'Unauthorized'
};
}

// Rest of your validation logic
// ...

return request;
}

3. Consider using a condition based on the request path: If MediaTailor only accesses specific paths, you can also add path-based conditions to your function:

// Allow requests to manifest and segment paths that might be accessed by MediaTailor
if (request.uri.endsWith('.m3u8') || request.uri.endsWith('.mpd') || 
request.uri.endsWith('.ts') || request.uri.endsWith('.m4s') ||
request.uri.includes('/segment/') || request.uri.includes('/tm/') ||
request.uri.includes('/v1/')) {

// Additional checks specific to MediaTailor requests
// ...
}

4. Consider using Origin Access Control (OAC) or Origin Access Identity (OAI) for your S3 bucket if that's your origin, rather than relying solely on header validation.

5. Use separate cache behaviors: You could create separate cache behaviors in your CloudFront distribution - one for paths accessed by MediaTailor without the function attached, and another for public access with your security function.

By implementing these changes, you can maintain your security controls for public clients while allowing MediaTailor to access the content it needs for ad insertion.
Sources
Securing AWS Elemental MediaTailor origin interactions with SigV4 - AWS Elemental MediaTailor
Cloudfront CDN is not working with Videos | AWS re:Post
Troubleshoot common CloudFormation deployment issues for CDN and MediaTailor integrations - AWS Elemental MediaTailor