Examkin

Question

Difficulty: MediumAmazon CloudFront Caching, Origins, and Security

A company uses an Amazon CloudFront distribution to serve private content from a primary Amazon S3 bucket. The company has configured a secondary S3 bucket in a different AWS Region as a backup origin within a CloudFront origin group. All objects in both S3 buckets are encrypted using regional customer managed keys (SSE-KMS). A SysOps administrator needs to ensure that CloudFront can securely retrieve and decrypt content from both S3 buckets, and that failover can occur seamlessly when needed.

Which TWO actions should the SysOps administrator take to meet these requirements? (Select TWO.)

  1. Create a CloudFront Origin Access Control (OAC) and associate it with both S3 origins in the CloudFront distribution.Answer
  2. Modify the key policies for the customer managed KMS keys in both regions to grant decrypt permissions (kms:Decrypt) to the CloudFront service principal (cloudfront.amazonaws.com), restricting access to the distribution ARN.Answer
  3. C
    Attach an IAM policy containing kms:Decrypt to the CloudFront distribution's IAM execution role to delegate decrypt permissions without altering the key policies.
  4. D
    Configure an active-passive DNS failover routing policy in Amazon Route 53 to redirect client traffic to the secondary S3 bucket's regional endpoint when CloudFront returns origin connection errors.
  5. E
    Configure S3 Cross-Region Replication (CRR) to replicate the encrypted files to the secondary S3 bucket, while keeping S3 Versioning disabled on the secondary bucket to minimize storage costs.

Answer

Create a CloudFront Origin Access Control (OAC) and associate it with both S3 origins in the CloudFront distribution, and modify the key policies for the customer managed KMS keys in both regions to grant decrypt permissions to the CloudFront service principal.
To secure the private S3 buckets and allow CloudFront to serve the KMS-encrypted files, the administrator must create an Origin Access Control (OAC) and assign it to both origins. Additionally, because the files are encrypted with customer managed keys, the KMS key policy in both regions must grant the CloudFront service principal decrypt permissions, restricted to the distribution ARN.

Step-by-Step Solution

1
Associate an Origin Access Control (OAC) with the origins.
CloudFront uses OAC to sign requests to both the primary and secondary S3 origins in the origin group.
OAC is required to restrict access to S3 origins and supports KMS-encrypted objects.
2
Update the KMS key policies in both regions.
The CloudFront service principal is authorized to call the decrypt API.
Since customer managed keys are used for encryption, CloudFront needs explicit decryption permissions in the key policy.
3
Ensure S3 bucket policies allow CloudFront access.
S3 permits GetObject requests from the CloudFront service principal targeting the specific distribution.
Both private S3 buckets must trust the CloudFront distribution to serve their contents.

Key Concept

Securing a CloudFront multi-region S3 origin group with Origin Access Control (OAC) and AWS KMS decryption permissions.
Rate this question

Topics

Amazon CloudFront Caching, Origins, and Security

More questions from this topic