DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Set the bucket policy to allow access only from CloudFront IP addresses.

  Why it's wrong here

  Setting a bucket policy to allow access only from CloudFront IP addresses is an unreliable and unscalable approach. CloudFront's edge locations utilize a large and dynamic range of IP addresses that are not static or publicly documented for this purpose. Relying on a fixed list of IPs would quickly become outdated, leading to intermittent access failures or requiring constant, impractical maintenance.

• ✗

  Set the bucket policy to allow access only from AWS services.

  Why it's wrong here

  A bucket policy that broadly allows access from 'AWS services' is insufficiently granular for securing an S3 origin. This policy would permit access from various AWS services, not exclusively the specific CloudFront distribution intended, potentially exposing the content to other AWS accounts or services. It fails to enforce the principle of least privilege by not restricting access to the designated CloudFront distribution alone.

• ✗

  Set the bucket policy to allow public read access and use CloudFront signed URLs.

  Why it's wrong here

  Granting public read access to the S3 bucket directly exposes all its content to the internet, irrespective of whether CloudFront signed URLs are employed. While signed URLs control access through CloudFront, the S3 bucket itself remains publicly accessible, creating a significant security vulnerability. This negates the purpose of securing the origin and is not a secure configuration for private content.

• ✓

  Create an origin access identity (OAI) and grant it read access in the bucket policy.

  Why this is correct

  Creating an Origin Access Identity (OAI) and granting it read access in the S3 bucket policy is the recommended and most secure method. The OAI acts as a virtual user for your CloudFront distribution, allowing only that specific distribution to retrieve content from the S3 bucket. This prevents direct public access to the S3 bucket while enabling CloudFront to serve the content securely to end-users.