Question

A media company hosts a static website with downloadable assets in an S3 bucket and serves it globally through CloudFront. Security requires that the S3 bucket be completely private and only accessible through the CloudFront distribution, and the solution must support SSE-KMS encrypted objects while following current AWS best practices. Which approach meets these requirements?

Accepted Answer

Configure Origin Access Control (OAC) on the CloudFront distribution and update the S3 bucket policy to grant access to the distribution's service principal, and grant CloudFront use of the KMS key.

Answer

Use a legacy Origin Access Identity (OAI) and restrict the bucket policy to the OAI's canonical user ID.

Answer

Enable S3 Block Public Access and make the CloudFront distribution use the S3 static website endpoint as a custom origin.

Answer

Attach a bucket policy that allows access only from CloudFront's published edge IP ranges referenced via the aws:SourceIp condition.