SOA-C02 Question 263
Select 3You are tasked with configuring an Amazon CloudFront distribution to serve content securely from an Amazon S3 bucket. The S3 bucket should not allow direct public access, and access should only be permitted via CloudFront. Which of the following steps should you take to achieve this configuration?
- A
Enable Origin Access Control (OAC) for the CloudFront distribution and associate it with the S3 bucket.
- B
Update the S3 bucket policy to allow access to the CloudFront origin access identity (OAI).
- C
Update the S3 bucket policy to allow access to the CloudFront OAC's signing principal.
- D
Ensure the CloudFront distribution is configured to use HTTPS only.
- E
Make the S3 bucket publicly accessible for CloudFront to fetch objects.
Show answer and explanation
Correct answers: A, C, D
Explanation
To securely serve content from an S3 bucket via CloudFront while preventing direct public access, you should enable Origin Access Control (OAC) for the CloudFront distribution. OAC provides a secure mechanism for allowing CloudFront to access the S3 bucket. You must also update the bucket policy to permit access to the OAC's signing principal, ensuring only CloudFront can retrieve objects from the bucket. Finally, configuring CloudFront to use HTTPS ensures that content is delivered securely to end users. Making the bucket publicly accessible would contradict the security requirement.
- A. Correct.
Correct. Enabling Origin Access Control (OAC) allows CloudFront to securely access the S3 bucket without making it publicly accessible.
- B. Incorrect.
Incorrect. OAC replaces the need for configuring bucket policies for the older origin access identity (OAI). This step is not required when using OAC.
- C. Correct.
Correct. When using OAC, you must update the bucket policy to allow access to the CloudFront OAC's signing principal, ensuring only CloudFront can access the bucket.
- D. Correct.
Correct. Configuring CloudFront to use HTTPS ensures secure delivery of content to end users.
- E. Incorrect.
Incorrect. Making the S3 bucket publicly accessible is unnecessary and violates the security requirement of not allowing direct public access.