SAA-C03 practice question: S3 access control (1 of 2)

Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A media company stores downloadable reports in an Amazon S3 bucket and serves them to customers through an Amazon CloudFront distribution. Every object is encrypted with SSE-KMS using a customer managed key. A penetration test found that the reports can still be downloaded directly from the bucket's S3 URL. The company must make the objects readable only through this one distribution, without changing how the objects are encrypted. What should a solutions architect do?

Choose one answer.

A. Create an origin access identity (OAI) for the distribution, grant the OAI s3:GetObject in the bucket policy, and remove all other public access.
B. Use origin access control, allow the CloudFront service principal for this distribution in the bucket and key policies, and block public access.
C. Turn on static website hosting, point CloudFront at the website endpoint, and have the bucket policy allow reads only with a secret header.
D. Require CloudFront signed URLs through a trusted key group on the distribution, and keep the existing bucket policy that allows public reads.

Show the answer and explanation

Answer: B

A. Wrong: An OAI can restrict a bucket to CloudFront, but it does not support objects encrypted with SSE-KMS, so CloudFront could not read these reports. Origin access control replaced OAI and supports SSE-KMS when the key policy allows CloudFront. Learn more: Restrict access to an Amazon S3 origin (opens in a new tab)
B. Right: Correct. Origin access control signs CloudFront's requests to S3 and supports SSE-KMS. The bucket policy and the KMS key policy allow the cloudfront.amazonaws.com principal only when AWS:SourceArn is this distribution, and Block Public Access stops direct downloads. Learn more: Restrict access to an Amazon S3 origin (opens in a new tab)
C. Wrong: A website endpoint can only be a custom origin, so neither origin access control nor OAI can be used. The bucket policy must still allow anonymous reads, protected only by a header value that anyone who learns it can send. Origin access control on the REST endpoint is the recommended approach. Learn more: Hosting a static website using Amazon S3 (opens in a new tab)
D. Wrong: Signed URLs control who can fetch content through CloudFront, but they do nothing for requests sent straight to S3. With public reads still allowed, the bypass remains. Locking the bucket to the distribution needs origin access control. Learn more: Serve private content with signed URLs and signed cookies (opens in a new tab)

Explanation

Origin access control (OAC) is the AWS-recommended way to make an S3 bucket readable only through a CloudFront distribution. Unlike the older origin access identity, OAC supports SSE-KMS: the key policy must allow the CloudFront service principal, scoped to the distribution with AWS:SourceArn, just like the bucket policy. Signed URLs and website endpoints do not stop direct access to the bucket.

Study

Restrict access to an Amazon S3 origin

SAA-C03 practice question: S3 access control (1 of 2)

Explanation

Study

Keep practising