Put the media bucket back behind CloudFront
A hands-on SAA-C03 lab. You produce the real artefact and 10 automated checks verify it behaves the way the exam expects.
Try this labAll SAA-C03 practice
- Certification
- SAA-C03
- Format
- Structured configuration
- Difficulty
- hard
- Estimated time
- 16 min
- Automated checks
- 10
The brief
Repair bucket-policy.json so the assets bucket is private again. The distribution already has origin access control and signs every origin request, so nothing about the distribution changes - only this policy. Remove the public grant. Leave exactly one Allow statement that grants s3:GetObject to the CloudFront service principal, targets the objects in the supplied bucket rather than the bucket itself, and carries a Condition on AWS:SourceArn naming the supplied distribution so that a distribution in another account cannot use the same grant. Do not reach for the legacy origin access identity principal.
Part of SAA-C03 preparation
Labs are written by ExamNova to teach the decisions the exam tests. They are not reproductions of vendor lab content.