SCS-C02 Question 186
Select 2An organization is hosting a web application on Amazon CloudFront with an Amazon S3 bucket as its origin. The application is exposed to the internet, and the company needs to implement security controls to ensure only requests from CloudFront are allowed to access the S3 bucket. Additionally, they want to protect the application from common web exploits. Which combination of solutions will meet these requirements?
- A
Implement an S3 bucket policy that only allows requests with the CloudFront Origin Access Control (OAC).
- B
Use AWS WAF with CloudFront to protect the web application from common web exploits.
- C
Enable CloudFront's Field-Level Encryption to secure specific data fields in requests.
- D
Configure the S3 bucket to allow public read access for all incoming requests.
- E
Create an IAM role that allows CloudFront to access the S3 bucket and attach it to the bucket.
Show answer and explanation
Correct answers: A, B
Explanation
To secure edge services, the organization must ensure that only CloudFront can access the S3 bucket by implementing a bucket policy tied to CloudFront's Origin Access Control (OAC). Additionally, using AWS WAF with CloudFront provides protection against common web exploits. These measures together fulfill the security requirements for edge services by restricting unauthorized access and safeguarding the application.
- A. Correct.
Correct. Configuring an S3 bucket policy with the CloudFront Origin Access Control (OAC) ensures that only CloudFront can access the S3 bucket, preventing unauthorized access.
- B. Correct.
Correct. AWS WAF integrates with CloudFront and helps protect the application from common web exploits like SQL injection and cross-site scripting (XSS).
- C. Incorrect.
Incorrect. While Field-Level Encryption is a useful feature for securing sensitive data fields, it does not address the requirement to restrict access to the S3 bucket or protect against common exploits.
- D. Incorrect.
Incorrect. Allowing public read access to the S3 bucket exposes the content to everyone on the internet, which violates the security requirements.
- E. Incorrect.
Incorrect. While IAM roles can be used for access control, they are not designed to restrict S3 bucket access specifically to CloudFront. The recommended approach is to use Origin Access Control (OAC) or Origin Access Identity (OAI) with an S3 bucket policy.