TIL: CloudFront Origin Access Control blocks the Host header

Signing requests to a private origin means the Host header cannot be forwarded, which quietly breaks anything that depends on it.

When CloudFront signs requests to a private origin with Origin Access Control, it must control the Host header itself — the signature is computed over it. Forwarding the viewer’s Host therefore is not allowed, and any origin request policy that tries is rejected.

The practical consequences are worth knowing before you design around them:

CloudFront-Viewer-Country and similar viewer headers need an origin request policy that forwards Host, so you cannot have them and OAC together.
The Authorization header is also rewritten, so it cannot carry your own token to the origin.

Neither is a problem if you find out at design time. Both are an afternoon if you find out afterwards.