SCS-C02 · Question #54
A company is designing a solution to serve content from an Amazon CloudFront distribution that will have an Amazon S3 bucket as the origin. A security engineer needs to encrypt S3 data at rest with…
The correct answer is A. Create the S3 bucket. Configure server-side encryption with a customer managed KMS key. D. Create the CloudFront distribution. Use the S3 bucket as the origin. Delete the origin access F. Create a Lambda@Edge function that runs for origin request events and reads from the S3. Tough question. Instead of exposing your S3 bucket publicly to allow CloudFront to download objects, it is best to keep your bucket private using CloudFront Origin Access Identity (OAI). OAI is a special CloudFront user that is associated with an S3 origin and given the…
Question
A company is designing a solution to serve content from an Amazon CloudFront distribution that will have an Amazon S3 bucket as the origin. A security engineer needs to encrypt S3 data at rest with an AWS Key Management Service (KMS) customer managed key rather than with an S3 managed key. The solution must minimize operational overhead. Which combination of steps should the security engineer take to meet these requirements? (Choose three.)
Options
- ACreate the S3 bucket. Configure server-side encryption with a customer managed KMS key.
- BCreate the S3 bucket. Configure server-side encryption with customer-provided encryption keys
- CCreate the CloudFront distribution. Use the S3 bucket as the origin. Configure the distribution to
- DCreate the CloudFront distribution. Use the S3 bucket as the origin. Delete the origin access
- EConfigure the CloudFront distribution cache to encrypt data at rest by using the customer
- FCreate a Lambda@Edge function that runs for origin request events and reads from the S3
How the community answered
(29 responses)- A79% (23)
- B7% (2)
- C3% (1)
- E10% (3)
Explanation
Tough question. Instead of exposing your S3 bucket publicly to allow CloudFront to download objects, it is best to keep your bucket private using CloudFront Origin Access Identity (OAI). OAI is a special CloudFront user that is associated with an S3 origin and given the necessary permissions to access to objects within the bucket. Currently, OAI only supports SSE-S3, which means customers cannot use SSE-KMS with OAI. https://aws.amazon.com/blogs/networking-and-content-delivery/serving-sse-kms-encrypted- content-from-s3-using-cloudfront/
Topics
Community Discussion
No community discussion yet for this question.