You are building a large-scale confidential documentation web server on AWSand all of the documentation for it will be stored on S3. One of the requirements is that it cannot be publicly accessible…

Question

Options

• ACreate an Identity and Access Management (IAM) user for CloudFront and grant access to the
• BCreate an Origin Access Identity (OAI) for CloudFront and grant access to the objects in your S3
• CCreate individual policies for each bucket the documents are stored in and in that policy grant
• DCreate an S3 bucket policy that lists the CloudFront distribution ID as the Principal and the target

• A
  6% (2)
• B
  81% (26)
• C
  3% (1)
• D
  9% (3)

Explanation

If you want to use CloudFront signed URLs or signed cookies to provide access to objects in your Amazon S3 bucket you probably also want to prevent users from accessing your Amazon S3 objects using Amazon S3 URLs. If users access your objects directly in Amazon S3, they bypass the controls provided by CloudFront signed URLs or signed cookies, for example, control over the date and time that a user can no longer access your content and control over which IP addresses can be used to access content. In addition, if user's access objects both through CloudFront and directly by using Amazon S3 URLs, CloudFront ace logs are less useful because they're Option A is invalid because you need to create a Origin Access Identity for Cloudfront and not an Option C and D are invalid because using policies will not help fulfil the requirement. restrictine-access-to-s3.htmll

No community discussion yet for this question.