Examkin

Question

Difficulty: HardAmazon CloudFront Caching, Origins, and Security

An administration team needs to secure a collection of premium media files delivered via an Amazon CloudFront distribution. The media files are stored in a private Amazon S3 bucket and encrypted using an AWS KMS customer managed key. The security requirements state that the S3 bucket must not be publicly accessible, and access to the files must be restricted to authorized subscribers. Additionally, subscribers must be able to view multiple files in a single session without changing the application's current URL paths.

Which combination of configurations will meet these requirements? (Select TWO.)

  1. Configure the CloudFront distribution to use signed cookies, and update the application to set these cookies in the user's browser.Answer
  2. Configure the CloudFront distribution to use Origin Access Control (OAC), and update both the S3 bucket policy and the KMS key policy to allow the CloudFront service principal access.Answer
  3. C
    Configure the CloudFront distribution to use Origin Access Identity (OAI), and update both the S3 bucket policy and the KMS key policy to allow the OAI access.
  4. D
    Configure the CloudFront distribution to use signed URLs, and configure the application to generate a unique signed URL for every media file request.
  5. E
    Configure the CloudFront origin settings to assume an IAM role with S3 and KMS permissions, and attach a trust policy allowing CloudFront to assume the role.

Answer

The correct configurations are to use signed cookies to restrict access to multiple files without altering URLs, and to use Origin Access Control (OAC) while updating both the S3 bucket policy and the KMS key policy to allow access to the CloudFront service principal.
To secure premium files stored in S3 and encrypted with SSE-KMS while maintaining the same URL paths for multiple files, the SysOps administrator must configure CloudFront signed cookies and Origin Access Control (OAC). Signed cookies allow users to access multiple premium files in a single session without modifying individual resource URLs, which would be required if signed URLs were used. Furthermore, OAC is the only origin access method that supports S3 buckets encrypted with custom KMS keys (SSE-KMS). The KMS key policy must be updated to grant the CloudFront service principal (cloudfront.amazonaws.com) permission to decrypt the objects using the key.

Step-by-Step Solution

1
Analyze the access restriction requirements.
Identify that signed cookies are required because the subscribers need access to multiple files without changing the application's URL paths.
Signed URLs require modifying URLs for individual resources, whereas signed cookies allow access to multiple files under a directory or pattern using the same URL paths.
2
Determine the origin security and encryption requirements.
Identify that Origin Access Control (OAC) must be used instead of Origin Access Identity (OAI) since the S3 bucket is encrypted with an AWS KMS customer managed key.
OAI does not support SSE-KMS encrypted origins, whereas OAC allows CloudFront to sign requests to KMS and decrypt encrypted S3 objects.
3
Determine the policy updates needed for KMS-encrypted S3 with OAC.
Identify that both the S3 bucket policy and the KMS key policy must explicitly allow the CloudFront service principal (cloudfront.amazonaws.com) to perform s3:GetObject and kms:Decrypt operations.
By default, CloudFront cannot decrypt KMS-encrypted S3 objects without explicit permission granted in the key policy for the CloudFront service principal.

Key Concept

CloudFront Private Content Security and KMS-Encrypted Origins
Rate this question

Topics

Amazon CloudFront Caching, Origins, and Security

More questions from this topic