Exam AWS Certified Security - Specialty topic 1 question 312 discussion

Amazon S3 is the only object storage service that allows you to block public access to all of your objects at the bucket or the account level, now and in the future by using S3 Block Public Access. A - Good B - cannot prevent future public buckets from being created. C - DNS records of the 'webpages directly on Amazon S3 buckets' need to point to CF now. D - OAI, not CloudFront points of presence, is used for identifying the coming traffic from CF

To restrict access to content that you serve from Amazon S3 buckets, follow these steps: Create a special CloudFront user called an origin access identity (OAI) and associate it with your distribution. Configure your S3 bucket permissions so that CloudFront can use the OAI to access the files in your bucket and serve them to your users. Make sure that users can’t use a direct URL to the S3 bucket to access a file there. "D" is the answer

Keyword: "ban all current and FUTURE public buckets." Therefore the choice is to block public access on the account level, to block public bucket creation in the future, rather than blocking blocking public access to existing buckets only. Search and identify keywords that edges one option over the other. In this question, it edges A over B (D is not even an option).

A IS THE ANSWER

A no doubts... You need: OAI + CF + Enable block public access settings at the account level.

We need to block S3 public access at the account level. When this security control is configured it applies account-wide for all current and future buckets.

Answer is A: D : What is the need to configure the S3 bucket policy to accept connections from the CloudFront points of presence only? It has to be configured using OAI or OAC so I think the answer is A

C is bogus B is wrong because future S3 buckets can still be public D is wrong as it is missing OAI A is right

Correct Answer is D. A is missing the bucket policy.

It's A

A should be answer - OAI

A. To block the public S3 buckets, the security engineer should enable block public access settings at the account level. This will block all current and future public buckets in the account. To prevent outages on the existing websites, the security engineer should configure an S3 bucket as the origin for the CloudFront distribution and switch the DNS records for the websites to point to the CloudFront distribution. This will allow the websites to continue to be served from the S3 buckets through the CloudFront distribution.

1#.You can use the S3 console, AWS CLI, AWS SDKs, and REST API to configure block public access settings for your all the buckets in your account. https://docs.aws.amazon.com/AmazonS3/latest/userguide/configuring-block-public-access-account.html 2#. When you use CloudFront with an Amazon S3 bucket as the origin, you can configure CloudFront and Amazon S3 .....To do this, configure CloudFront to send authenticated requests to Amazon S3, and configure Amazon S3 to only allow access to authenticated requests from CloudFront. CloudFront provides two ways to send authenticated requests to an Amazon S3 origin: origin access control (OAC) and origin access identity (OAI). https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#private-content-restricting-access-to-s3-oai

I'd say its D, regardless of using OAI or OAC, you need to modify your bucket policy to allow cloudfront distribution access S3 files. Also OAC is the new way of limiting access and Amazon recommends using it over OAI: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#migrate-from-oai-to-oac

https://aws.amazon.com/s3/features/block-public-access/#:~:text=Amazon%20S3%20is%20the%20only,on%20block%20all%20public%20access. Amazon S3 is the only object storage service that allows you to block public access to all of your objects at the bucket or the account level, now and in the future by using S3 Block Public Access. To ensure that public access to all your S3 buckets and objects is blocked, turn on block all public access.

Option A for sure.

B for me