Examkin

Question

Difficulty: MediumAmazon CloudFront Caching, Origins, and Security

A SysOps Administrator is configuring an Amazon CloudFront distribution to serve private files from an Amazon S3 bucket. The S3 bucket is encrypted with SSE-KMS using an AWS Key Management Service (AWS KMS) customer managed key. The administrator creates an Origin Access Control (OAC), associates it with the distribution's S3 origin, and updates the S3 bucket policy to allow the CloudFront service principal to retrieve objects. Despite these configurations, when users attempt to access files via CloudFront, they receive an HTTP 403 Forbidden error.

Which of the following actions will resolve this issue?

  1. Update the key policy of the AWS KMS customer managed key to grant the CloudFront service principal permissions to perform the kms:Decrypt action.Answer
  2. B
    Update the S3 bucket policy to grant the CloudFront service principal permission to perform the kms:Decrypt action.
  3. C
    Configure the CloudFront distribution to use an Origin Access Identity (OAI) and enable automatic KMS key decryption in the OAI settings.
  4. D
    Configure the S3 bucket's route table to associate a gateway endpoint for S3 and enable route propagation.

Answer

Update the key policy of the AWS KMS customer managed key to grant the CloudFront service principal permissions to perform the kms:Decrypt action.
When an S3 bucket is encrypted with an AWS KMS customer managed key (SSE-KMS), CloudFront needs permission to use the KMS key to decrypt the objects it retrieves. Because S3 bucket policies cannot delegate KMS permissions, you must update the KMS key policy to allow the CloudFront service principal (cloudfront.amazonaws.com) to execute the kms:Decrypt action.

Step-by-Step Solution

1
Identify the origin type and encryption mechanism used for the S3 bucket.
The origin is S3 and it uses AWS KMS (SSE-KMS) with a customer managed key.
CloudFront OAC requires explicit KMS key permissions to decrypt objects encrypted with customer managed KMS keys.
2
Analyze why the S3 bucket policy update alone is insufficient for SSE-KMS encrypted objects.
The bucket policy can grant access to the S3 actions but cannot delegate permissions to the KMS key.
KMS key access is governed strictly by the KMS key policy, which must trust the CloudFront service principal.
3
Determine the required modification to the KMS key policy.
Add a statement to the KMS key policy that allows the 'cloudfront.amazonaws.com' service principal to perform 'kms:Decrypt'.
This allows CloudFront to decrypt the encrypted files on behalf of the client requests.

Key Concept

Amazon CloudFront OAC integration with S3 buckets encrypted with AWS KMS customer managed keys.
Estimated Time:1m 30s
Rate this question

Topics

Amazon CloudFront Caching, Origins, and Security

More questions from this topic