These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-001
A web application delivers static files stored in Amazon S3 through CloudFront. You do not want to expose the S3 bucket publicly and want to allow access only from CloudFront. Which configuration is the most appropriate?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: C. Use CloudFront Origin Access Control and allow only GetObject from the CloudFront distribution in the S3 bucket policy.
Explanation
To restrict access to CloudFront only without exposing S3 directly, use CloudFront Origin Access Control and allow only access from the specific CloudFront distribution in the S3 bucket policy.
Per-choice explanations
A. Disable Block Public Access on the S3 bucket and allow GetObject for all users in the bucket policy.
Incorrect. Exposing the bucket conflicts with the requirement to avoid direct S3 access.
B. Set a public-read ACL on each S3 object.
Incorrect. Object ACL public exposure violates the principle of minimal exposure.
C. Use CloudFront Origin Access Control and allow only GetObject from the CloudFront distribution in the S3 bucket policy.
Correct. OAC keeps S3 private while delivering content securely through CloudFront.
D. Enable S3 static website hosting and set the website endpoint as the CloudFront origin.
Incorrect. S3 static website endpoints cannot be combined with OAC and typically require the bucket to be public.
Practical Use
CloudFront Origin Access Control (OAC) is the mechanism that allows delivery only through CloudFront without exposing the S3 bucket. By keeping S3 Block Public Access enabled and writing a bucket policy that allows only GetObject from a specific CloudFront distribution, you can structurally block direct S3 access. Combined with signed URLs or signed cookies, you can layer additional access control at the CloudFront layer. OAC is positioned as the successor to the legacy Origin Access Identity (OAI), and OAC is recommended for new builds. A design consideration is that the S3 static website hosting endpoint cannot be combined with OAC. Because the website endpoint assumes HTTP public access, when there is a requirement to protect with OAC you must specify the REST API endpoint (bucket FQDN) as the origin. In addition, the standard configuration is to set the CloudFront behavior's Viewer Protocol Policy to Redirect HTTP to HTTPS, attach an ACM certificate (issued in us-east-1), and enforce HTTPS delivery. On SAA-C03, OAC frequently appears as the correct answer in contexts such as "deliver from S3 through CloudFront while keeping S3 private" or "maintain the principle of minimal exposure." Distractors line up choices that expose the bucket, such as disabling Block Public Access, setting public object ACLs, or using the S3 website endpoint. The differences between OAI and OAC (OAC is newer and supports SSE-KMS and SigV4 regional signatures) are also commonly asked.