# S3OriginConfig

S3 origin configuration for CloudFront.

- Source: [`aws-cloudfront/lib/web-distribution.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-cloudfront/lib/web-distribution.ts#L315)
- Type last changed: v2.234.0 · 8 Jan 2026

## Example

```ts
declare const sourceBucket: s3.Bucket;
const viewerCertificate = cloudfront.ViewerCertificate.fromIamCertificate('MYIAMROLEIDENTIFIER', {
  aliases: ['MYALIAS'],
});

new cloudfront.CloudFrontWebDistribution(this, 'MyCfWebDistribution', {
  originConfigs: [
    {
      s3OriginSource: {
        s3BucketSource: sourceBucket,
      },
      behaviors : [ {isDefaultBehavior: true} ],
    },
  ],
  viewerCertificate: viewerCertificate,
});
```

## Properties

- `originAccessIdentity`: any — The optional Origin Access Identity of the origin identity cloudfront will use when calling your s3 bucket.

  **Default:** No Origin Access Identity which requires the S3 bucket to be public accessible

- `originHeaders`: { [key: string]: string } — Any additional headers to pass to the origin.

  **Default:** No additional headers are passed.

- `originPath`: string = / — The relative path to the origin root to use for sources.

- `originShieldRegion`: string — When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance.

  **Default:** origin shield not enabled

- `s3BucketSource`: [IBucket](/cdk/api/v2/docs/aws-cdk-lib.aws_s3.IBucket.html) (required) — The source bucket to serve content from.