ExamPark
Course menuSCS-C03

Exams / SCS-C03 / Securing CloudFront origins and edge access (OAC, signed URLs, headers, CORS) / Question 1

SCS-C03 practice question: Securing CloudFront origins and edge access (OAC, signed URLs, headers, CORS)

Infrastructure Security A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A video streamer serves its catalog from an Amazon S3 bucket through an Amazon CloudFront distribution. The objects are encrypted with a customer managed AWS KMS key, because the studio's contracts require that key.

Viewers must reach the videos only through CloudFront. The bucket must not allow public access, and the setup must keep working for new objects that are encrypted with that KMS key.

Which configuration meets these requirements?

Choose one answer.

  1. A. Attach an origin access control to the distribution. Allow the CloudFront service principal to read for this distribution in the bucket policy, and to decrypt in the KMS key policy.
  2. B. Create a legacy origin access identity for the S3 origin, add it to the bucket policy as the only reader, and leave the KMS key policy unchanged, since CloudFront already reads the bucket.
  3. C. Make the bucket public for reads so that CloudFront can reach it, and add a bucket policy that denies requests that do not come from CloudFront IP ranges.
  4. D. Have the application generate a presigned Amazon S3 URL for each video, and let CloudFront pass the signed URLs to viewers, with no bucket policy change and no origin access setting on the distribution.
Show the answer and explanation

Answer: A

  • A. Right: Correct. Origin access control signs the requests to S3, and the bucket policy limits reads to this distribution. OAC works with SSE-KMS objects once the key policy allows CloudFront to decrypt, which the legacy identity does not support. Learn more: Restricting access to Amazon S3 origins (opens in a new tab)
  • B. Wrong: A legacy origin access identity cannot read objects that are encrypted with SSE-KMS, so the videos would fail to load. The key policy also still has to allow the reader to decrypt.
  • C. Wrong: Public read access breaks the no-public-access requirement, and IP ranges change over time. An IP-based deny is also a weak way to limit reads to one distribution.
  • D. Wrong: Presigned URLs are checked by S3 for each link, not by CloudFront, so the design leaves the distribution out of the access control. The bucket would also still need its public access blocked.

Explanation

Origin access control keeps the bucket private and limits reads to one distribution. It also covers SSE-KMS objects when the key policy grants decrypt to the CloudFront service principal. A legacy identity, a public bucket and presigned URLs each fail a stated requirement.

CloudFront with origin access control reading an SSE-KMS encrypted S3 bucket Users reach the objects through CloudFront, which signs its requests to the S3 bucket with origin access control. The bucket policy and the KMS key policy both allow the CloudFront service principal for this one distribution. A request straight to the S3 URL is denied. Users CloudFront signs with OAC S3 bucket policy: this distribution KMS key policy: this distribution Direct S3 URL denied
Origin access control signs CloudFront's requests, and both the bucket and key policies allow only this distribution.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SCS-C03 practice examPractice Securing CloudFront origins and edge access (OAC, signed URLs, headers, CORS)All Securing CloudFront origins and edge access (OAC, signed URLs, headers, CORS) questions

Want more on Securing CloudFront origins and edge access (OAC, signed URLs, headers, CORS)? The 5 full-length practice sets have 5 more Securing CloudFront origins and edge access (OAC, signed URLs, headers, CORS) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets