SAA-C03 · Question #638
A company is developing a file-sharing application that stores files an Amazon S3 bucket. The company wants to serve all the files through an Amazon CloudFront distribution. The company does not want
The correct answer is D. Create an origin access control (OAC). Assign the OAC to the CloudFront distribution. Configure. An Origin Access Control (OAC) allows CloudFront to securely access an S3 bucket while blocking all direct access from the public internet. By assigning the OAC to the CloudFront distribution and granting the OAC permission to read objects in the S3 bucket, files are served only
Question
A company is developing a file-sharing application that stores files an Amazon S3 bucket. The company wants to serve all the files through an Amazon CloudFront distribution. The company does not want the files to be accessible through direct navigation to the S3 bucket URL. Which solution will meet these requirements?
Options
- ACreate an S3 bucket policy that grants read permissions to CloudFront.
- BCreate an IAM user. Grant the IAM user read permissions for objects in the S3 bucket. Assign the
- CWrite an S3 bucket policy that assigns the CloudFront distribution ID as the principal and assigns
- DCreate an origin access control (OAC). Assign the OAC to the CloudFront distribution. Configure
How the community answered
(45 responses)- A16% (7)
- B7% (3)
- C2% (1)
- D76% (34)
Explanation
An Origin Access Control (OAC) allows CloudFront to securely access an S3 bucket while blocking all direct access from the public internet. By assigning the OAC to the CloudFront distribution and granting the OAC permission to read objects in the S3 bucket, files are served only through CloudFront, preventing direct access via the S3 bucket URL. This is the recommended and most secure modern approach for private S3 content delivery.
Community Discussion
No community discussion yet for this question.