Examkin

Soru

Zorluk: KolayAmazon CloudFront Caching, Origins, and Security

A SysOps Administrator needs to restrict access to an Amazon S3 bucket so that users can only access the content through an Amazon CloudFront distribution. The administrator wants to use the most secure, modern AWS-recommended method to prevent direct public access to the S3 bucket. Which configuration should the administrator implement to meet these requirements?

  1. Configure an Origin Access Control (OAC) for the S3 origin in CloudFront, and update the S3 bucket policy to allow access only to the CloudFront service principal representing the OAC.Cevap
  2. B
    Create a Route 53 CNAME record pointing to the S3 bucket's regional domain name, and configure it as the zone apex record for the distribution.
  3. C
    Apply an IAM policy requiring iam:PassRole permissions on the S3 bucket, and associate it with the viewer protocol policy.
  4. D
    Enable CloudWatch Detailed Monitoring on the CloudFront distribution to automatically block direct HTTP GET requests targeting the S3 bucket.

Cevap

Configure an Origin Access Control (OAC) for the S3 origin in CloudFront, and update the S3 bucket policy to allow access only to the CloudFront service principal representing the OAC.
The correct configuration is to configure an Origin Access Control (OAC) on the CloudFront distribution and update the S3 bucket policy. This combination ensures that the S3 bucket only accepts requests that are signed and sent by the CloudFront distribution, preventing direct public access via S3 endpoint URLs.

Adım Adım Çözüm

1
Identify the AWS-recommended mechanism to secure S3 origins in CloudFront.
Origin Access Control (OAC) is selected as the modern security mechanism, replacing the legacy Origin Access Identity (OAI).
OAC provides enhanced security features, including support for Signature Version 4 and server-side encryption with AWS KMS.
2
Configure the S3 bucket policy to grant read access to CloudFront.
The S3 bucket policy is modified to allow the s3:GetObject action, restricting the principal to the CloudFront service principal ('cloudfront.amazonaws.com') and specifying the distribution's ARN.
This policy ensures that only requests routed through the authorized CloudFront distribution can retrieve content from the S3 bucket, while direct public requests are denied.

Anahtar Kavram

Securing Amazon S3 origins in Amazon CloudFront using Origin Access Control (OAC)
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Amazon CloudFront Caching, Origins, and Security

Bu konudan daha fazla soru