SOA-C02 Question 261
Select 3You are setting up a website that serves content via Amazon CloudFront with an Amazon S3 bucket as the origin. To ensure that the S3 bucket objects are not accessible directly via the bucket URL and can only be accessed through CloudFront, you configure Origin Access Control (OAC). After setting up the OAC, which additional steps are required to secure the S3 bucket and ensure proper functionality?
- A
Update the S3 bucket policy to allow access only from the OAC's associated CloudFront distribution.
- B
Enable public access to the S3 bucket to ensure CloudFront can retrieve objects.
- C
Associate the OAC with the CloudFront distribution's origin configuration.
- D
Remove all existing bucket policies to prevent potential conflicts with OAC.
- E
Enable the 'Block all public access' setting on the S3 bucket.
Show answer and explanation
Correct answers: A, C, E
Explanation
To ensure secure access to an S3 bucket via CloudFront using Origin Access Control (OAC), you need to configure the S3 bucket policy to allow access only through the OAC, associate the OAC with the CloudFront distribution’s origin, and enable the 'Block all public access' setting on the S3 bucket. This setup prevents direct access to the S3 bucket and ensures that objects are accessible only through the CloudFront distribution.
- A. Correct.
Correct: You must update the S3 bucket policy to explicitly allow access only from the OAC associated with the CloudFront distribution. This ensures that CloudFront can retrieve objects securely without direct public access.
- B. Incorrect.
Incorrect: Enabling public access to the S3 bucket is unnecessary and counterproductive. OAC is specifically designed to secure access to the S3 bucket without making it publicly accessible.
- C. Correct.
Correct: Associating the OAC with the CloudFront distribution's origin configuration is a key step to enable secure access to the S3 bucket through CloudFront.
- D. Incorrect.
Incorrect: While removing conflicting bucket policies may help in some cases, it is not a requirement when setting up OAC. You can update the existing policies to accommodate OAC without removing them entirely.
- E. Correct.
Correct: Enabling the 'Block all public access' setting on the S3 bucket ensures that no objects are accessible publicly, complementing the OAC configuration to secure access.