Question

A media company hosts static website assets and downloadable files in an Amazon S3 bucket, distributed globally through Amazon CloudFront. Security requires that the S3 bucket must NOT be publicly accessible, and objects should only be reachable through the CloudFront distribution. Which approach meets these requirements with the least ongoing management effort?

Accepted Answer

Configure CloudFront Origin Access Control (OAC) and update the S3 bucket policy to allow access only from the CloudFront distribution, while keeping Block Public Access enabled.

Answer

Make the S3 bucket objects public with a bucket policy and rely on CloudFront geo-restrictions to limit access.

Answer

Place the S3 bucket behind a Network Load Balancer and restrict inbound access using a security group that references the CloudFront IP ranges.

Answer

Generate S3 presigned URLs for every object and embed them in the CloudFront distribution configuration.