SOA-C02 Networking and Content Delivery Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure the S3 bucket policy to deny all access except from the CloudFront distribution's origin access identity (OAI).

  Why this is correct

  An Origin Access Identity (OAI) is a special CloudFront identity that can be assigned to a distribution, and the S3 bucket policy can explicitly grant read permission to that OAI's principal while using an explicit deny for all other principals. Since CloudFront signs requests as the OAI, only the distribution can fetch objects from the bucket; direct access to the S3 website or REST endpoint is rejected. This is the recommended AWS pattern because it relies on IAM evaluation of the caller identity rather than a client-controlled header or an IP-based allow list.

• ✗

  Make the S3 bucket private and use pre-signed URLs for CloudFront.

  Why it's wrong here

  Pre-signed URLs are designed for granting temporary, direct access to individual private S3 objects to specific users or applications, not for CloudFront to retrieve content from its origin. CloudFront cannot utilise pre-signed URLs to fetch objects from a private S3 bucket. This solution fails to provide the persistent, secure access mechanism (like an Origin Access Control) CloudFront requires to serve content. It is tempting as it addresses S3 privacy, and would be correct if the goal was to enable time-limited, direct client downloads of private files.

• ✗

  Use AWS WAF on CloudFront to block direct access to S3 by checking the Referer header.

  Why it's wrong here

  AWS WAF rules can inspect HTTP headers, but the Referer header is supplied by the client and can be trivially modified with tools like curl or browser extensions, so it does not establish the caller's identity. A user who knows the S3 REST URL can simply spoof a Referer that matches the allow condition, defeating the block. WAF is also not designed to restrict who can access an S3 origin directly; it only applies to traffic that arrives at CloudFront, leaving the S3 bucket endpoint itself unguarded unless a separate bucket policy enforce exists.

• ✗

  Create a VPC endpoint for S3 and restrict access to the bucket from the CloudFront IP addresses.

  Why it's wrong here

  VPC endpoints provide private connectivity between a VPC and AWS services, and the associated bucket policy condition can restrict access by the endpoint ID, not by CloudFront IP addresses. CloudFront's global edge IP range is large and dynamic, so a policy that references those IPs is brittle and operationally difficult to maintain. Furthermore, CloudFront does not originate from within a VPC, so it cannot traverse a VPC endpoint; the correct method is to grant the OAI or Origin Access Control access in the bucket policy.