Examkin

Soru

Zorluk: OrtaAmazon CloudFront Caching, Origins, and Security

A SysOps administrator is configuring an Amazon CloudFront distribution to serve static content from an Amazon S3 bucket. The company's security policy requires that all viewer traffic must access the bucket through CloudFront, and direct public access to the S3 bucket must be completely blocked. Additionally, the website must be accessible via the company's root domain (example.com). Which configuration steps should the administrator implement to meet these requirements?

  1. Create an Origin Access Control (OAC) and associate it with the CloudFront distribution. Update the S3 bucket policy to allow the CloudFront OAC service principal access to perform the s3:GetObject action, and create an Alias record in Amazon Route 53 at the zone apex pointing to the CloudFront distribution.Cevap
  2. B
    Create an Origin Access Control (OAC) and associate it with the CloudFront distribution. Update the S3 bucket policy to allow the CloudFront OAC service principal access to perform the s3:GetObject action, and create a CNAME record in Amazon Route 53 at the zone apex pointing to the CloudFront distribution.
  3. C
    Configure an S3 Gateway Endpoint in the VPC, associate it with the subnet route tables, and restrict the S3 bucket policy to allow access only from the VPC endpoint. Create an Alias record in Amazon Route 53 at the zone apex pointing to the CloudFront distribution.
  4. D
    Create an Origin Access Control (OAC) and associate it with the CloudFront distribution. Grant the administrator's IAM role the iam:PassRole permission to pass the CloudFront service role to the S3 bucket, and create an Alias record in Amazon Route 53 at the zone apex pointing to the CloudFront distribution.

Cevap

Create an Origin Access Control (OAC) and associate it with the CloudFront distribution, update the S3 bucket policy to allow the CloudFront OAC service principal access to perform the s3:GetObject action, and create an Alias record in Route 53 at the zone apex pointing to the CloudFront distribution.
The correct configuration uses Origin Access Control (OAC) to secure the S3 origin, allowing only authenticated requests from the CloudFront distribution by updating the S3 bucket policy to authorize the CloudFront service principal. To resolve the root domain (zone apex) to the CloudFront distribution, a Route 53 Alias record is required because CNAME records are not allowed at the zone apex by standard DNS specifications.

Adım Adım Çözüm

1
Secure the S3 origin with Origin Access Control.
CloudFront is configured to sign requests sent to the S3 origin using OAC.
This establishes a secure identity for the CloudFront distribution to authenticate with the S3 bucket.
2
Restrict the S3 bucket policy to CloudFront OAC.
The S3 bucket blocks direct public access and only permits s3:GetObject requests matching the CloudFront OAC service principal.
This ensures that users cannot bypass CloudFront to download assets directly from the bucket.
3
Configure DNS routing for the root domain in Route 53.
An Alias record is created at the zone apex (example.com) pointing to the CloudFront distribution's DNS name.
Standard DNS CNAME records cannot coexist with other record types at the zone apex, so a Route 53 Alias record must be used to route the root domain's traffic.

Anahtar Kavram

CloudFront Origin Access Control (OAC) and Route 53 Zone Apex Routing
Bu soruyu puanla

Konular

Amazon CloudFront Caching, Origins, and Security

Bu konudan daha fazla soru