CloudFront distributes objects from an S3 bucket.
Prevent users from retrieving the objects directly from the S3 URL.
Which configuration is most appropriate?
Configure CloudFront Origin Access Control and keep the S3 bucket private.
Detailed explanation
DNS visibility does not change the S3 bucket policy or object authorization.
DNS visibility does not change the S3 bucket policy or object authorization.
A public bucket permits direct URL access and removes origin protection.
A public bucket permits direct URL access and removes origin protection.
OAC lets the bucket policy allow signed CloudFront-origin requests while denying direct public access.
OAC lets the bucket policy allow signed CloudFront-origin requests while denying direct public access.
An alarm can notify but does not enforce S3 access permissions.
An alarm can notify but does not enforce S3 access permissions.
Check official documentation
Compare the following points with the official documentation.
CloudFront Origin Access Control with S3の公式説明を確認する。
What to confirm
OAC、公開バケット、DNS秘匿の違いを説明できる。
Key points
- Origin Access Control
- Private S3 bucket
- CloudFront
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Origin authorization
The bucket policy controls which CloudFront identity may read objects.
Name hiding versus access control
A private DNS name does not replace an S3 authorization policy.