Question

A SysOps administrator serves static website assets from an Amazon S3 bucket through an Amazon CloudFront distribution. The security team requires that users can only reach the objects via the CloudFront distribution URL and must not be able to download objects directly using the S3 bucket URL. The bucket currently has Block Public Access enabled at the bucket level. What should the administrator configure to meet this requirement?

Accepted Answer

Create an Origin Access Control (OAC) for the distribution and add an S3 bucket policy that grants s3:GetObject only to the CloudFront service principal for that distribution.

Answer

Disable S3 Block Public Access and add a public-read bucket policy so CloudFront can retrieve the objects from the origin.

Answer

Attach a security group to the S3 bucket that only allows inbound traffic from the CloudFront edge location IP ranges.

Answer

Configure a Route 53 alias record pointing the S3 bucket endpoint to the CloudFront distribution so requests are forced through CloudFront.