A company's website runs on an Amazon EC2 Linux instance. The website needs to serve PDF files from an Amazon S3 bucket. All public access to the S3 bucket is blocked at the account level. The…

Question

Options

• ACreate an IAM role that has a policy that allows s3:list* and s3:get* permissions. Assign the role
• BCreate an Amazon CloudFront distribution that uses an origin access control (OAC) that points to
• CChange the S3 bucket permissions to allow public access on the source S3 bucket. Assign a
• DDeploy an EC2 instance that has an IAM instance profile to a public subnet. Use a signed URL

• A
  6% (2)
• B
  78% (25)
• C
  3% (1)
• D
  13% (4)

Explanation

Per the AWS Cloud Operations, Networking, and Security documentation, the best practice for serving private S3 content securely to end users is to use Amazon CloudFront with Origin Access OAC enables CloudFront to access S3 buckets privately, even when Block Public Access settings are enabled at the account level. This allows content to be delivered globally and securely without making the S3 bucket public. The bucket policy explicitly allows access only from the CloudFront distribution, ensuring that users can retrieve PDF files only via CloudFront URLs. This configuration offers: Automatic scalability through CloudFront caching, Improved security via private access control, Minimal administration effort with fully managed services. Other options require manual handling or make the bucket public, violating AWS security best Therefore, Option B--using CloudFront with Origin Access Control and a restrictive bucket policy-- provides the most secure, efficient, and low-maintenance CloudOps solution.

No community discussion yet for this question.