A security engineer needs to set up an Amazon CloudFront distribution for an Amazon S3 bucket that hosts a static website. The security engineer must allow only specified IP addresses to access the…

Question

Options

• AGenerate an S3 bucket policy. Specify cloudfront.amazonaws.com as the principal. Use the
• BCreate a CloudFront origin access control (OAC). Create the S3 bucket policy so that only the
• CImplement security groups to allow only the specified IP addresses access and to restrict S3
• DCreate an S3 bucket access point to allow access from only the CloudFront distribution. Create

• A
  5% (2)
• B
  79% (31)
• C
  3% (1)
• D
  13% (5)

Explanation

Option B is correct because CloudFront Origin Access Control (OAC) is the modern, AWS-recommended mechanism to ensure S3 content is only served through CloudFront - the S3 bucket policy grants s3:GetObject permission exclusively to the OAC, so direct S3 URL requests are denied. IP-based restrictions are enforced at the CloudFront level using AWS WAF or CloudFront's IP allowlist, satisfying both requirements cleanly.

Option A is outdated - using cloudfront.amazonaws.com as the bucket policy principal is an older pattern associated with Origin Access Identity (OAI), which AWS has deprecated in favor of OAC; it also doesn't address IP restriction.

Option C is wrong because S3 is a managed service and does not support security groups - security groups apply to VPC-based resources like EC2, not S3 buckets.

Option D is a distractor because S3 Access Points are designed for managing access within AWS accounts and services, not for CloudFront integration as a mechanism to block direct S3 URL access while enforcing IP restrictions.

Memory tip: Think OAC = "Only Allow CloudFront" - whenever a question asks how to prevent direct S3 URL access through a CloudFront distribution, OAC + a scoped bucket policy is always the correct modern answer.

No community discussion yet for this question.