DVA-C02 Deployment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use a bucket policy that allows access only if the Referer header matches the CloudFront distribution domain.

  Why it's wrong here

  Relying on the Referer HTTP header for access control is fundamentally insecure because this header can be easily spoofed by malicious actors. While it might appear to restrict direct access, any client can manipulate the Referer value to impersonate a legitimate CloudFront request, thereby bypassing the intended security measure and directly accessing the S3 bucket content. This method provides a false sense of security and does not adequately protect the origin.

• ✗

  Make the bucket public and use CloudFront's default caching.

  Why it's wrong here

  Making the S3 bucket publicly accessible allows anyone on the internet to directly access its contents, bypassing CloudFront entirely. While CloudFront would still cache content, the origin bucket itself would be exposed to direct requests, potential enumeration, and unauthorized access, negating the security benefits of using CloudFront as a protective layer. This configuration fails to secure the origin, which is a primary goal when using CloudFront with S3.

• ✗

  Grant CloudFront access by allowing the CloudFront IP address range.

  Why it's wrong here

  Granting access based on CloudFront's IP address ranges is an impractical and unreliable security measure. CloudFront's IP address ranges are dynamic, frequently change, and are extensive, making it difficult to maintain an accurate and up-to-date bucket policy. Furthermore, these IP ranges are shared across all CloudFront users, meaning this approach does not uniquely identify your CloudFront distribution, potentially allowing other CloudFront users to access your bucket if they know the URL.

• ✓

  Grant CloudFront access via an origin access identity (OAI) and restrict the bucket policy to the OAI.

  Why this is correct

  Granting CloudFront access through an Origin Access Identity (OAI) is the recommended and most secure method. An OAI is a special CloudFront user that you associate with your distribution, and then you modify the S3 bucket policy to explicitly grant read permissions only to this specific OAI. This ensures that content can only be accessed through your CloudFront distribution, preventing direct public access to the S3 bucket and securing your origin.

Go deeper

Related to this question