A company stores private customer documents in an S3 bucket. They want only CloudFront to be able to read objects from the bucket (no direct S3 URL access), even if the bucket name and object key are known. Which configuration best meets this requirement?

Attach an AWS WAF Web ACL to CloudFront and allow public reads on the S3 bucket so WAF can block direct object access.

WAF evaluates requests that arrive at CloudFront; it does not control access to objects requested directly from S3 using the S3 endpoint. If the bucket allows public reads, anyone who knows the object URL can download it without passing through CloudFront/WAF.

Create IAM users with s3:GetObject permissions and share the IAM credentials with customers so they can fetch objects directly from S3.

Providing customers with long-lived credentials violates least-privilege and significantly increases the blast radius of any credential leak. It also does not prevent direct S3 access; customers would still be able to call the S3 endpoint directly.

Enable S3 static website hosting on the bucket and use the S3 website endpoint as the CloudFront origin so access controls can be enforced at CloudFront.

S3 static website endpoints do not support the same access control model as S3 REST endpoints used with OAC. As a result, this commonly leads to weaker origin protection and does not provide the strict origin authorization guarantees that bucket policies + OAC provide for private content.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Use CloudFront Origin Access Control (OAC) and update the bucket policy to allow s3:GetObject only when the principal is cloudfront.amazonaws.com and aws:SourceArn equals the CloudFront distribution ARN. — Use CloudFront Origin Access Control (OAC) with an S3 bucket policy that grants s3:GetObject only to the cloudfront.amazonaws.com service principal when aws:SourceArn matches the specific CloudFront distribution ARN. This makes S3 enforce access at authorization time: only requests made through your CloudFront distribution are allowed, and direct S3 requests that bypass CloudFront do not satisfy the bucket policy conditions and are denied. WAF cannot protect against direct S3 URL access when the bucket is publicly readable. Sharing IAM credentials still enables direct S3 access. S3 static website hosting does not provide the origin-level authorization model required for strict private content access using OAC and bucket policy conditions.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.