Examkin

Question

Difficulty: EasyAmazon CloudFront Caching, Origins, and Security

A SysOps administrator is configuring an Amazon CloudFront distribution to serve static content from an Amazon S3 bucket. The administrator must secure the content so that viewers can only access the files through CloudFront, preventing direct access to the S3 bucket. Which action should the administrator take to meet this security requirement?

  1. Enable origin access control (OAC) on the CloudFront distribution and update the S3 bucket policy to allow read access to the CloudFront service principal.Answer
  2. B
    Configure an Elastic Load Balancing health check on the S3 bucket to verify that only CloudFront requests are accepted, routing traffic to a backup bucket if access is direct.
  3. C
    Attach an IAM policy to the CloudFront distribution that uses the iam:PassRole action to delegate access to the S3 bucket.
  4. D
    Set up an S3 Gateway Endpoint in the VPC and associate it with the subnet route tables used by CloudFront edge locations to bypass the public internet.

Answer

Enable origin access control (OAC) on the CloudFront distribution and update the S3 bucket policy to allow read access to the CloudFront service principal.
Enabling origin access control (OAC) on the CloudFront distribution and updating the S3 bucket policy to allow read access to the CloudFront service principal restricts direct S3 access. OAC signs the requests sent to S3 using AWS Signature Version 4, and the bucket policy permits access only when the request is signed by the designated CloudFront distribution.

Step-by-Step Solution

1
Configure the CloudFront distribution origin settings by enabling Origin Access Control (OAC) for the S3 origin.
CloudFront will begin signing all requests to the S3 origin using the CloudFront service principal credentials.
This establishes the identity framework that allows S3 to verify that incoming requests are coming from the designated CloudFront distribution.
2
Modify the S3 bucket policy to allow 's3:GetObject' action where the principal is the CloudFront service principal ('cloudfront.amazonaws.com') and the condition specifies the ARN of the CloudFront distribution.
The S3 bucket will allow requests initiated by the CloudFront distribution while rejecting all other direct requests.
This enforces the security boundary by validating the signature generated by CloudFront and blocking anonymous or direct access.

Key Concept

Securing an Amazon S3 origin using CloudFront Origin Access Control (OAC)
Rate this question

Topics

Amazon CloudFront Caching, Origins, and Security

More questions from this topic