A media company streams video content globally. They use Amazon S3 for storage and Amazon CloudFront for delivery. Recently, they noticed a spike in S3 egress costs. Investigation reveals that users in certain countries are bypassing CloudFront and accessing the S3 bucket directly via its public URL. How can the Architect enforce that all access goes through CloudFront, preventing direct S3 access?

Answer options:

Configure CloudFront with Origin Access Control (OAC). Update the S3 bucket policy to allow s3:GetObject only from the CloudFront service principal.

Enable S3 Block Public Access. Create an IAM user for CloudFront and embed the access keys in the CloudFront origin settings.

Configure AWS WAF on the S3 bucket to block requests that do not contain a custom HTTP header added by CloudFront.

Use Amazon Route 53 geolocation routing to redirect direct S3 requests back to the CloudFront distribution.

How to approach this question

Identify the mechanism used to secure S3 origins behind CloudFront.

Full Answer

A.Configure CloudFront with Origin Access Control (OAC). Update the S3 bucket policy to allow s3:GetObject only from the CloudFront service principal.✓ Correct

Configure CloudFront with Origin Access Control (OAC). Update the S3 bucket policy to allow s3:GetObject only from the CloudFront service principal.

To restrict access to an Amazon S3 bucket so that users can only access it through Amazon CloudFront, you use Origin Access Control (OAC). You configure the S3 bucket policy to deny direct access and only allow the `cloudfront.amazonaws.com` service principal to perform `s3:GetObject` actions.

Common mistakes

Selecting WAF, forgetting that WAF cannot be attached directly to S3.

Question 17 All questions Question 19

Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 5

75 questions · hints · full answers · grading

More questions from this exam

Q01A global enterprise is redesigning its AWS network architecture across 50 AWS accounts and 3 AWS ...Hard Q02A company uses AWS Organizations to manage multiple accounts. The security team mandates that no ...Medium Q03A financial institution requires a disaster recovery strategy for its critical trading applicatio...Hard Q04An enterprise is setting up a new multi-account AWS environment using AWS Control Tower. They nee...Medium Q05A company has a complex AWS environment with hundreds of linked accounts under AWS Organizations....Hard

View all 75 questions →