Cloudfront S3 MRAP

It sounds like you are encountering an authentication issue when accessing your multi-region access point. By default, Amazon S3 requires that requests are signed using Signature Version 4 (SigV4) to ensure that the request is authorized and secure.

When you access your S3 buckets through a multi-region access point, you need to include the region-specific endpoint in the request URL. The endpoint will be in the format https://<mrap-name>.s3-accesspoint.<region>.amazonaws.com. The <region> placeholder should be replaced with the region code where the access point is located (e.g., ap-south-1 or us-east-1 in your case).

To sign your requests with SigV4, you can use the AWS SDKs or the AWS CLI. The SDKs and CLI automatically sign the requests for you, so you don't need to write a separate Lambda function to do this.

To use the AWS CLI, you can configure your AWS credentials by running the aws configure command. Once your credentials are configured, you can use the aws s3 command to interact with your S3 buckets. For example, to list the contents of a bucket in a specific region through a multi-region access point, you can run the following command:

aws s3 ls s3://<mrap-name> --region <region> --endpoint-url https://<mrap-name>.s3-accesspoint.<region>.amazonaws.com

You can also use the SDKs to interact with S3 and sign your requests with SigV4. The specific steps for signing your requests will depend on the SDK you are using, but there are SDKs available for most programming languages.

By signing your requests with SigV4 and including the region-specific endpoint in the request URL, you should be able to access your multi-region access point without encountering the "authorization mechanism not supported" error.

hope this helps

You cannot use a Multi-Region Access Point as the distribution origin for Amazon CloudFront. However, you can configure Multi-Region Access Points as a custom distribution origin with Amazon CloudFront. For more information, see Building an active-active, proximity-based application across multiple Regions on the AWS Storage Blog. https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPointRestrictions.html

Multi-Region Access Point's require SigV4A authentication and Amazon CloudFront does not support this currently when using the S3 Distribution Origin. Multi-Region Access Point's also do not support unauthenticated (anonymous) access.

As a workaround, you can generate SigV4A authentication via a Lambda@Edge function.

You might also consider CloudFront Origin Failover, and this solution to perform Geo based routing.