How to add Cross-Origin-Resource-Policy on AWS CloudFront

Last updated November 11, 2026 · Reviewed by a CISSP-certified security practitioner

To add Cross-Origin-Resource-Policy on AWS CloudFront, set the header in Response headers policy with the value same-origin. Stops other sites from loading your resources. Attach the policy to the distribution's cache behavior and wait for deployment. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does Cross-Origin-Resource-Policy do?

CORP tells browsers which origins may embed your images, scripts and other resources.

Risk if missing: Other sites can embed your resources and use side channels to leak data.

What is the AWS CloudFront configuration?

Add this to Response headers policy:

Response headers policy

// aws cloudfront create-response-headers-policy --response-headers-policy-config file://policy.json
{
  "Name": "fixsecurityheaders-policy",
  "SecurityHeadersConfig": {},
  "CustomHeadersConfig": {
    "Quantity": 1,
    "Items": [
      {
        "Header": "Cross-Origin-Resource-Policy",
        "Value": "same-origin",
        "Override": true
      }
    ]
  }
}

How do I add it step by step?

Open Response headers policy.
Paste the Cross-Origin-Resource-Policy configuration shown below.
Attach the policy to the distribution's cache behavior and wait for deployment.
Run curl -I https://yourdomain.com and look for the cross-origin-resource-policy line.
Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal

curl -sI https://yourdomain.com | grep -i "cross-origin-resource-policy"
# expected:
# cross-origin-resource-policy: same-origin

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

Public CDNs and assets meant for embedding should use cross-origin.
AWS provides a managed SecurityHeadersPolicy, but a custom policy lets you set CSP.
Enable Override so origin headers don't win.

Quick reference

Header	`Cross-Origin-Resource-Policy`
Recommended value	`same-origin`
Stack	AWS CloudFront
Where	Response headers policy
Compliance	OWASP ASVS V14.4

FAQ

What value should I use for Cross-Origin-Resource-Policy?

A safe default is same-origin. Public CDNs and assets meant for embedding should use cross-origin.

Why isn't Cross-Origin-Resource-Policy showing up on AWS CloudFront?

AWS provides a managed SecurityHeadersPolicy, but a custom policy lets you set CSP. Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does Cross-Origin-Resource-Policy affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference Cross-Origin-Resource-Policy?

OWASP ASVS V14.4.