Examkin

Soru

Zorluk: OrtaAmazon CloudFront Caching, Origins, and Security

A company hosts a static website on Amazon S3. The website's assets are encrypted using server-side encryption with AWS KMS customer managed keys (SSE-KMS). A SysOps administrator is configuring an Amazon CloudFront distribution to serve these assets securely using Origin Access Control (OAC). Which TWO actions must the administrator take to allow CloudFront to retrieve and serve the encrypted assets? (Select TWO.)

  1. Update the Amazon S3 bucket policy to grant the s3:GetObject permission to the CloudFront service principal, specifying the distribution ARN in the aws:SourceArn condition.Cevap
  2. Update the AWS KMS key policy of the customer managed key to grant the kms:Decrypt permission to the CloudFront service principal, specifying the distribution ARN in the aws:SourceArn condition.Cevap
  3. C
    Create an Amazon CloudFront Origin Access Identity (OAI), associate it with the distribution, and update the S3 bucket policy to grant read access to the OAI.
  4. D
    Attach an IAM role with kms:Decrypt permissions to the CloudFront distribution to allow it to decrypt S3 objects on behalf of viewers.
  5. E
    Configure a Route 53 CNAME record pointing to the S3 bucket domain to bypass CloudFront cache configuration for encrypted files.

Cevap

To allow CloudFront to serve KMS-encrypted S3 assets using Origin Access Control (OAC), the SysOps administrator must update the S3 bucket policy to grant s3:GetObject permissions to the CloudFront service principal, and update the KMS key policy of the customer managed key to grant kms:Decrypt permissions to the CloudFront service principal, both restricted by the distribution's ARN using the aws:SourceArn condition.
The correct options involve configuring the Amazon S3 bucket policy to grant the s3:GetObject permission and configuring the AWS KMS key policy of the customer managed key to grant the kms:Decrypt permission. Both permissions must be granted to the CloudFront service principal (cloudfront.amazonaws.com) and scoped to the specific distribution ARN using the aws:SourceArn condition.

Adım Adım Çözüm

1
Configure the S3 bucket policy to trust the CloudFront service principal.
The bucket policy allows the s3:GetObject action when the requester is the CloudFront service principal and matches the specific distribution ARN.
This establishes standard Origin Access Control (OAC) authorization at the S3 bucket layer.
2
Configure the KMS key policy of the customer managed key.
The key policy allows the kms:Decrypt action to the CloudFront service principal with a condition verifying the distribution's ARN.
Since the objects are encrypted using SSE-KMS, the caller (CloudFront) needs explicit permission to decrypt the objects using the KMS key.

Anahtar Kavram

Using Origin Access Control (OAC) with SSE-KMS encrypted S3 origins in CloudFront.
Bu soruyu puanla

Konular

Amazon CloudFront Caching, Origins, and Security

Bu konudan daha fazla soru