Exam AWS-SysOps topic 1 question 321 discussion

I would go with A. But I don't understand why C is not a good option here

A. Many companies that distribute content over the internet want to restrict access to documents, business data, media streams, or content that is intended for selected users, for example, users who have paid a fee. To securely serve this private content by using CloudFront, you can do the following: Require that your users access your private content by using special CloudFront signed URLs or signed cookies. Require that your users access your content by using CloudFront URLs, not URLs that access content directly on the origin server (for example, Amazon S3 or a private HTTP server). Requiring CloudFront URLs isn't necessary, but we recommend it to prevent users from bypassing the restrictions that you specify in signed URLs or signed cookies.

A is the correct answer.

Correct Answer: A

A. Generate pre-signed URLs for each user as they request access to protected S3 content

Ans : A The maximum expiration time for presigned url is one week from time of creation. But there is a way that you can make it for longer period of time,possibly for years. Also credentials are stored on Database. So application can easily get the credentials from db. In general, if you're using an Amazon S3 bucket as the origin for a CloudFront distribution, you can either allow everyone to have access to the files there, or you can restrict access. If you select answer D, everyone can access. Becoz D is never mentioned that CloudFront Origin Identity used along with Signed URl or signed cookie.