SOA-C02 Question 264
Select 3You are setting up a CloudFront distribution to serve content from an Amazon S3 bucket. To ensure secure access to the S3 bucket and block direct access to its objects, you decide to configure Origin Access Control (OAC). After creating the OAC, which of the following additional steps must you take to complete the setup and enforce secure access?
- A
Attach the OAC to the CloudFront distribution's origin settings.
- B
Update the bucket policy to allow access only from the OAC's managed identity.
- C
Enable bucket versioning to track access requests made via CloudFront.
- D
Remove any existing bucket policies that allow public access to the S3 bucket.
- E
Enable server-side encryption for objects in the S3 bucket.
Show answer and explanation
Correct answers: A, B, D
Explanation
To securely serve content from an S3 bucket via CloudFront using Origin Access Control (OAC), you must attach the OAC to the CloudFront distribution and update the S3 bucket policy to allow access only from the OAC's managed identity. Additionally, to enforce secure access, any existing bucket policies that allow public access must be removed. These steps ensure that content is only accessible through the CloudFront distribution and not directly from the S3 bucket.
- A. Correct.
Correct. After creating an OAC, you must attach it to the CloudFront distribution's origin settings to enable secure access to the S3 bucket.
- B. Correct.
Correct. The bucket policy must be updated to explicitly allow access from the OAC's managed identity, ensuring only CloudFront can access the S3 bucket.
- C. Incorrect.
Incorrect. Bucket versioning is not required to enforce secure access via OAC. It is used for data protection and recovery purposes.
- D. Correct.
Correct. Public access to the S3 bucket must be removed to ensure that all access is funneled through CloudFront, leveraging the OAC for security.
- E. Incorrect.
Incorrect. While enabling server-side encryption is a good practice for data security, it is not directly related to configuring OAC or restricting access to the S3 bucket.