SAA-C03 practice question: S3 access control (1 of 2)
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A media company stores downloadable reports in an Amazon S3 bucket and serves them to customers through an Amazon CloudFront distribution.
Every object is encrypted with SSE-KMS using a customer managed key. A penetration test found that the reports can still be downloaded directly from the bucket's S3 URL.
The company must make the objects readable only through this one distribution, without changing how the objects are encrypted.
What should a solutions architect do?
Choose one answer.
AA. Create an origin access identity (OAI) for the distribution, grant the OAI s3:GetObject in the bucket policy, and remove all other public access.
BB. Use origin access control, allow the CloudFront service principal for this distribution in the bucket and key policies, and block public access.
CC. Turn on static website hosting, point CloudFront at the website endpoint, and have the bucket policy allow reads only with a secret header.
DD. Require CloudFront signed URLs through a trusted key group on the distribution, and keep the existing bucket policy that allows public reads.
Show the answer and explanation
Answer: B
A. Wrong: An OAI can restrict a bucket to CloudFront, but it does not support objects encrypted with SSE-KMS, so CloudFront could not read these reports. Origin access control replaced OAI and supports SSE-KMS when the key policy allows CloudFront. Learn more: Restrict access to an Amazon S3 origin (opens in a new tab)
B. Right: Correct. Origin access control signs CloudFront's requests to S3 and supports SSE-KMS. The bucket policy and the KMS key policy allow the cloudfront.amazonaws.com principal only when AWS:SourceArn is this distribution, and Block Public Access stops direct downloads. Learn more: Restrict access to an Amazon S3 origin (opens in a new tab)
C. Wrong: A website endpoint can only be a custom origin, so neither origin access control nor OAI can be used. The bucket policy must still allow anonymous reads, protected only by a header value that anyone who learns it can send. Origin access control on the REST endpoint is the recommended approach. Learn more: Hosting a static website using Amazon S3 (opens in a new tab)
Origin access control (OAC) is the AWS-recommended way to make an S3 bucket readable only through a CloudFront distribution. Unlike the older origin access identity, OAC supports SSE-KMS: the key policy must allow the CloudFront service principal, scoped to the distribution with AWS:SourceArn, just like the bucket policy. Signed URLs and website endpoints do not stop direct access to the bucket.
Both policies name the same distribution, so CloudFront can read and decrypt the objects while a direct S3 request is refused.
Want more on S3 access control? The 5 full-length practice sets have 10 more S3 access control questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →