You serve private reports stored in an S3 bucket through CloudFront. After a recent change, users report that they can access the S3 object URLs directly (bypassing CloudFront), which violates your design. You want to ensure S3 objects are readable only through CloudFront using Origin Access Control (OAC), even if someone guesses the S3 URL. Which update best enforces this at the S3 bucket level?

Enable an S3 bucket lifecycle policy to transition objects to Glacier, so public S3 URLs become inaccessible.

Lifecycle transitions do not prevent public access. Users could still access objects while they exist in a readable storage class.

Rely only on CloudFront signed URLs validation; do not change the S3 bucket policy.

Signed URLs control CloudFront access but do not restrict direct S3 access. If the bucket allows it, S3 URLs will still work.

Add a WAF rule on CloudFront to block requests that contain "amazonaws.com" in the URL path.

WAF rules apply at CloudFront, not S3. Direct S3 requests would bypass CloudFront, so WAF cannot protect the bucket.

What does this SAA-C03 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Add a bucket policy Allow for s3:GetObject only when the principal is cloudfront.amazonaws.com and aws:SourceArn matches your CloudFront distribution ARN, while blocking public access. — To prevent direct S3 URL access, the S3 bucket policy must explicitly allow s3:GetObject only for CloudFront’s OAC requests and restrict them to your specific distribution. A common secure pattern is: Allow s3:GetObject to the CloudFront service principal (cloudfront.amazonaws.com) when aws:SourceArn equals the CloudFront distribution ARN, and ensure S3 public access is blocked. Signed URLs alone only protect the CloudFront path; they do not stop someone from accessing S3 objects directly if the bucket policy permits it. Option B changes storage class over time but does not provide access control; direct S3 URL access remains possible until objects become unreadable or deleted. Option C is insufficient because CloudFront signed URLs do not restrict S3’s own permissions. Option D cannot help because WAF evaluates requests hitting CloudFront; it cannot intercept direct requests to the S3 endpoint.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.