Examkin

Question

Difficulty: HardAmazon CloudFront Caching, Origins, and Security

A SysOps administrator is configuring a secure global content delivery network using Amazon CloudFront and Amazon S3. The S3 bucket contains sensitive assets encrypted using Server-Side Encryption with AWS KMS customer managed keys (SSE-KMS). The administrator sets up a CloudFront distribution and configures Origin Access Control (OAC) to restrict access to the S3 bucket. A bucket policy is applied to the S3 bucket that allows the CloudFront service principal cloudfront.amazonaws.com to perform s3:GetObject on the bucket. However, when test users attempt to download objects via CloudFront, they receive a 403 Forbidden error.

Which of the following configuration changes is required to resolve this error?

  1. Update the KMS key policy of the customer managed key to grant the CloudFront service principal permission to perform the kms:Decrypt action, using a condition to restrict access to the distribution ARN.Answer
  2. B
    Modify the S3 bucket policy to include the kms:Decrypt action in the statement that grants access to the CloudFront Origin Access Control.
  3. C
    Migrate the origin configuration from Origin Access Control (OAC) to an Origin Access Identity (OAI), as OAIs support automated SSE-KMS decryption without custom key policies.
  4. D
    Configure an IAM role with the kms:Decrypt and s3:GetObject permissions, attach this role to the CloudFront distribution configuration, and update the KMS key to trust the role.

Answer

Update the KMS key policy of the customer managed key to grant the CloudFront service principal permission to perform the kms:Decrypt action, using a condition to restrict access to the distribution ARN.
The correct answer is to update the KMS key policy of the customer managed key to grant the CloudFront service principal permission to perform the kms:Decrypt action, using a condition to restrict access to the distribution ARN. This is because when CloudFront OAC accesses S3 objects encrypted with SSE-KMS, the CloudFront service principal (cloudfront.amazonaws.com) needs the kms:Decrypt permission to decrypt the objects on behalf of the viewer. The permissions must be defined in the KMS key policy of the Customer Managed Key (CMK), restricted to the specific distribution ARN using a condition block for security.

Step-by-Step Solution

1
Identify the cause of the 403 Forbidden error.
Since the bucket policy already grants s3:GetObject to the OAC service principal, the blocker is the decryption step of the SSE-KMS customer managed key.
When S3 objects are encrypted with a customer managed KMS key, the caller must have both s3:GetObject permission on the bucket and kms:Decrypt permission on the KMS key.
2
Determine where the KMS decryption permission must be configured.
It must be configured on the customer managed key's key policy, not the S3 bucket policy.
KMS key policies are the primary authorization mechanism for KMS keys. An S3 bucket policy cannot delegate permissions for KMS resources.
3
Formulate the correct KMS key policy statement.
Grant the cloudfront.amazonaws.com service principal permission for kms:Decrypt with a condition block checking the SourceArn matching the distribution ARN.
This configuration safely allows the CloudFront service principal to decrypt objects only for this specific distribution, preventing unauthorized access.

Key Concept

CloudFront OAC integration with KMS-encrypted S3 origins
Rate this question

Topics

Amazon CloudFront Caching, Origins, and Security

More questions from this topic