SOA-C02 Question 262
Select 3You are setting up an Amazon CloudFront distribution with an Amazon S3 bucket as the origin. You want to ensure that the S3 bucket is only accessible through the CloudFront distribution and not directly via its public URL. Which steps should you take to configure this setup?
- A
Enable Origin Access Control (OAC) on the CloudFront distribution and link it to the S3 bucket.
- B
Modify the S3 bucket policy to allow access only from the CloudFront OAC.
- C
Enable public access on the S3 bucket to allow CloudFront to retrieve objects.
- D
Disable public access settings on the S3 bucket to prevent direct access.
- E
Create a CloudFront Function to block requests directly to the S3 bucket.
Show answer and explanation
Correct answers: A, B, D
Explanation
To allow an Amazon CloudFront distribution to securely access an S3 bucket while preventing direct access, you need to enable Origin Access Control (OAC) on CloudFront, update the bucket policy to allow access only from the OAC, and disable public access on the S3 bucket. This configuration ensures that all requests to the bucket are routed through CloudFront and unauthorized direct access is blocked.
- A. Correct.
Correct. Origin Access Control (OAC) ensures that CloudFront can securely access the S3 bucket and prevents unauthorized access.
- B. Correct.
Correct. The S3 bucket policy must explicitly allow access from the CloudFront OAC to ensure secure communication.
- C. Incorrect.
Incorrect. Enabling public access on the S3 bucket contradicts the requirement to block direct access.
- D. Correct.
Correct. Disabling public access settings on the S3 bucket ensures that it cannot be accessed directly via its public URL.
- E. Incorrect.
Incorrect. While a CloudFront Function can manipulate requests, it is not necessary to block direct access to the S3 bucket when OAC and bucket policies are correctly configured.