Examkin

Soru

Zorluk: Çok zorAmazon CloudFront Caching, Origins, and Security

A company uses an Amazon CloudFront distribution to serve its global application. The primary origin is an Application Load Balancer (ALB) serving dynamic API requests, and the secondary origin is an Amazon S3 bucket containing a static maintenance page configured within a CloudFront Origin Group for failover. The objects in the S3 bucket are encrypted using AWS KMS customer managed keys (SSE-KMS). During a recent test, a SysOps administrator notices two issues:
1. When failover to the S3 bucket is triggered, clients receive HTTP 403 Forbidden errors.
2. During normal operation, the ALB fails to process API client requests that require user authorization tokens because these headers are stripped before reaching the origin.

Which TWO actions should the SysOps administrator take to resolve these issues? (Select TWO.)

  1. Create an Origin Access Control (OAC) and associate it with the S3 origin. Update the S3 bucket policy to allow the CloudFront service principal `s3:GetObject` access, and update the KMS key policy to grant the CloudFront service principal `kms:Decrypt` permission.Cevap
  2. Associate the `Managed-AllViewerExceptHostHeader` Origin Request Policy and the `Managed-CachingDisabled` Cache Policy with the Application Load Balancer (ALB) cache behavior.Cevap
  3. C
    Create an Origin Access Identity (OAI) and associate it with the S3 origin. Update the S3 bucket policy to allow the OAI read access, and update the KMS key policy to grant the OAI `kms:Decrypt` permission.
  4. D
    Update the default Cache Policy associated with the Application Load Balancer (ALB) behavior to include the `Authorization` header in the Cache Key settings.
  5. E
    Configure the secondary S3 origin to use a S3 bucket policy that allows public read access (`s3:GetObject`) with a condition that restricts access to the VPC ID where the Application Load Balancer (ALB) is deployed.

Cevap

Create an Origin Access Control (OAC) and associate it with the S3 origin, updating the S3 bucket policy and KMS key policy for the CloudFront service principal. Additionally, associate the Managed-AllViewerExceptHostHeader Origin Request Policy and the Managed-CachingDisabled Cache Policy with the Application Load Balancer cache behavior.
To resolve the S3 failover access issue, the administrator must use Origin Access Control (OAC) because it supports S3 buckets encrypted with AWS KMS customer managed keys (SSE-KMS). The S3 bucket policy must allow `s3:GetObject` to the CloudFront service principal, and the KMS key policy must grant `kms:Decrypt` to the CloudFront service principal. To forward client authorization headers to the ALB without caching dynamic responses, the administrator must associate the `Managed-AllViewerExceptHostHeader` Origin Request Policy and the `Managed-CachingDisabled` Cache Policy with the ALB behavior.

Adım Adım Çözüm

1
Evaluate S3 origin secure access for KMS-encrypted files.
Determine that legacy Origin Access Identity (OAI) does not support S3 buckets encrypted with customer managed keys (SSE-KMS). Upgrading to Origin Access Control (OAC) is required.
Origin Access Control (OAC) enables CloudFront to sign requests to S3 and pass signature information to KMS for decryption.
2
Grant CloudFront permissions to S3 and KMS.
Update the S3 bucket policy to allow the CloudFront service principal to get objects, and update the KMS key policy to allow the service principal to decrypt.
OAC requires explicit permissions in both the bucket policy and the KMS key policy to execute the decrypt operation.
3
Address missing headers at the Application Load Balancer origin.
Separate caching logic from header forwarding logic by using an Origin Request Policy instead of adding headers to the cache key.
Adding authorization headers to the cache key degrades cache efficiency and poses security risks, whereas Origin Request Policies forward headers to the origin without caching.
4
Configure the Application Load Balancer cache behavior settings.
Associate the Managed-AllViewerExceptHostHeader Origin Request Policy and disable caching via the Managed-CachingDisabled Cache Policy.
This guarantees that user-specific authorization tokens reach the ALB backend for every request, and caching is bypassed for dynamic API content.

Anahtar Kavram

Amazon CloudFront caching behaviors, origin configuration (OAC vs. OAI), and secure integration with KMS-encrypted S3 and ALB origins.
Bu soruyu puanla

Konular

Amazon CloudFront Caching, Origins, and Security

Bu konudan daha fazla soru