Examkin

Question

Difficulty: HardAmazon CloudFront Caching, Origins, and Security

A company stores sensitive media assets in an Amazon S3 bucket encrypted with an AWS KMS customer managed key (SSE-KMS). A SysOps administrator is configuring an Amazon CloudFront distribution to serve these assets globally using a custom domain name at the zone apex (e.g., example.com). To meet security compliance, access to the S3 bucket must be restricted so that content is accessible only through CloudFront using Origin Access Control (OAC). Which combination of actions should the administrator perform to securely configure this architecture? (Select TWO.)

  1. Update the S3 bucket policy to allow the s3:GetObject action for the CloudFront service principal (cloudfront.amazonaws.com), specifying the Origin Access Control (OAC) ARN as the source ARN in the condition block.Answer
  2. Update the KMS key policy to allow the kms:Decrypt action for the CloudFront service principal (cloudfront.amazonaws.com), specifying the Origin Access Control (OAC) ARN as the source ARN in the condition block.Answer
  3. C
    Create a DNS CNAME record in Amazon Route 53 at the zone apex that points to the CloudFront distribution domain name.
  4. D
    Add the iam:PassRole permission to the CloudFront distribution settings to permit CloudFront to assume the S3 bucket's read role.
  5. E
    Configure an IAM user policy to grant the CloudFront service principal permission to decrypt the KMS key, without modifying the KMS key policy.

Answer

Update the S3 bucket policy to allow the s3:GetObject action for the CloudFront service principal conditional on the OAC ARN, and update the KMS key policy to allow the kms:Decrypt action for the CloudFront service principal conditional on the OAC ARN.
To secure S3 origins behind CloudFront distributions using customer managed KMS encryption, two configuration steps are vital: First, the S3 bucket policy must allow `s3:GetObject` requests originating from the OAC. Second, because S3 handles decryption using the customer managed KMS key, the KMS key policy must explicitly authorize the CloudFront service principal (`cloudfront.amazonaws.com`) to call `kms:Decrypt` when requested via the specific OAC.

Step-by-Step Solution

1
Configure the S3 Bucket Policy to authorize CloudFront OAC.
The bucket policy allows the cloudfront.amazonaws.com service principal to execute s3:GetObject only when the source ARN matches the OAC.
This restricts direct access to S3 objects and forces viewers to access content through CloudFront.
2
Configure the KMS Customer Managed Key Policy to authorize CloudFront OAC decryption.
The KMS key policy allows the cloudfront.amazonaws.com service principal to perform the kms:Decrypt operation.
Because objects are encrypted with SSE-KMS, CloudFront must have permissions to decrypt the assets during retrieval.

Key Concept

CloudFront Origin Access Control with SSE-KMS Encrypted S3 Origins
Rate this question

Topics

Amazon CloudFront Caching, Origins, and Security

More questions from this topic