Cloudfront Quiz
You are building a large-scale confidential documentation web server on AWS and all of its documentation will be stored on S3. One of the requirements is that it should not be publicly accessible from S3 directly, and CloudFront would be needed to accomplish this. Which of the methods listed below would satisfy the outlined requirements? Choose an answer from the options below.
A. Create an Identity and Access Management (IAM) user for CloudFront and grant access tothe objects in your S3 bucket to that IAM User.
B. Create an Origin Access Identity (OAI) for CloudFront and grant access to the objectsin your S3 bucket to that OAI.
C. Create individual policies for each bucket the documents are stored in, and grant access only to CloudFront in these policies.
D. Create an S3 bucket policy that lists the CloudFront distribution ID as the Principaland the target bucket as the Amazon Resource Name (ARN).
B. Create an Origin Access Identity (OAI) for CloudFront and grant access to the objectsin your S3 bucket to that OAI.
If you want to use CloudFront signed URLs or signed cookies to provide access to objects in your Amazon S3 bucket, you probably also want to prevent users from accessing your Amazon S3 objects using Amazon S3 URLs. If users access your objects directly in Amazon S3, they bypass the controls provided by CloudFront signed URLs or signed cookies, for example, control over the date and time that a user can no longer access your content and control over which IP addresses can be used to access content. In addition, if users access objects both through CloudFront and directly by using Amazon S3 URLs, CloudFront access logs are less useful because they’re incomplete.
For more information on Origin Access Identity, please see the below link:
http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
