Origin Access Control only protects the bucket if every viewer path that needs private objects goes through the distribution and the cache key cannot invent anonymous variants. Prefer one OAC-bound origin for the Multi-Region Access Point hostname, emit Cache-Control from the object or a response-headers policy so hashed assets stay long-lived at the edge, and avoid forwarding the full query string or Cookie on the default behaviour — each unique variant becomes its own object and a regional shield cannot collapse what the key already split.
Ops prove-out after wiring OAC and the cache policy: hit a hashed object twice and expect MISS then HIT with a rising Age, then fetch the HTML shell and confirm it stays on a short TTL or purge path. After replacing an object under the same key, run an invalidation for that path (or rely on versioned filenames) and re-check X-Cache until the old body is gone everywhere that mattered — most “update not visible” tickets are an un-invalidated edge object or a query variant still in the key, not a broken origin ACL.
CDN Edge Ops
Origin Access Control only protects the bucket if every viewer path that needs private objects goes through the distribution and the cache key cannot invent anonymous variants. Prefer one OAC-bound origin for the Multi-Region Access Point hostname, emit Cache-Control from the object or a response-headers policy so hashed assets stay long-lived at the edge, and avoid forwarding the full query string or Cookie on the default behaviour — each unique variant becomes its own object and a regional shield cannot collapse what the key already split.
Ops prove-out after wiring OAC and the cache policy: hit a hashed object twice and expect MISS then HIT with a rising Age, then fetch the HTML shell and confirm it stays on a short TTL or purge path. After replacing an object under the same key, run an invalidation for that path (or rely on versioned filenames) and re-check X-Cache until the old body is gone everywhere that mattered — most “update not visible” tickets are an un-invalidated edge object or a query variant still in the key, not a broken origin ACL.