Put the media bucket back behind CloudFront
Try this labAll SAA-C03 practice
- Certification
- SAA-C03
- Format
- Structured configuration
- Difficulty
- hard
- Estimated time
- 16 min
- Automated checks
- 10
SCENARIO
Subscriber media in acme-media-assets is served by CloudFront distribution arn:aws:cloudfront::111122223333:distribution/E2QWRUHAPOMQZL. Its origin access control signs every request, but a recent 403 workaround made the bucket public. Viewers now bypass the distribution using direct object URLs; the working distribution must stay intact.
TASK
Repair bucket-policy.json so only the supplied CloudFront distribution can read bucket objects.
- Retain one
Allowgrant and the supplied bucket scope, deny anonymous and foreign-distribution access, and permit no write, delete, or listing operations. - Use the existing origin access control.