Preventing Direct Access to S3 Bucket and Enhancing CloudFront Distribution

Correct Answers:A and C.

The AWS Documentation mentions the following.

To ensure that your users access your objects using only CloudFront URLs, regardless of whether the URLs are signed, perform the following tasks.

Create an origin access identity, which is a special CloudFront user, and associate the origin access identity with your distribution.

(For web distributions, you associate the origin access identity with origins so that you can secure all or just some of your Amazon S3 content.) You can also create an origin access identity and add it to your distribution when you create it.

Change the permissions either on your Amazon S3 bucket or on the objects in your bucket.

So only the origin access identity has read permission (or read and download permission)

When your users access your Amazon S3 objects through CloudFront, the CloudFront origin access identity gets the objects on behalf of your users.

If your users request objects directly by using Amazon S3 URLs, they're denied access.

The origin access identity has permission to access objects in your Amazon S3 bucket, but users don't.

Options B and D are incorrect since you need to create a CloudFront origin access identity and not an IAM user.

For more information on private content for S3, please refer to the below URL-

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html

The issue is that some users are bypassing the CloudFront distribution and directly accessing the S3 bucket. This means that they are not benefiting from the benefits of the CloudFront distribution, such as lower latency and improved user experience. To remediate this issue, the following steps can be performed:

A. Create a CloudFront Origin Access Identity (OAI): Creating a CloudFront OAI is the first step to improve security and ensure that only requests coming from CloudFront distribution can access the S3 bucket. An OAI is a special user that is created by CloudFront, and you can use it to restrict access to the S3 bucket only to CloudFront. You can configure the S3 bucket policy to allow access only from the OAI's identity.

C. Ensure that only the CloudFront Origin Access Identity has access to read objects from the S3 bucket: After creating the OAI, you can update the S3 bucket policy to restrict access to only the OAI. This means that requests coming from the CloudFront distribution will be allowed to access objects in the bucket, but direct requests to the S3 bucket will be denied.

B. Create a separate IAM user: Creating a separate IAM user is not directly related to the issue of users bypassing the CloudFront distribution. IAM users are used to manage access to AWS resources, and creating a separate IAM user can help improve security by limiting access to specific resources. However, in this case, it is not necessary to create a separate IAM user to remediate the issue.

D. Ensure that only the IAM user has access to read objects from the S3 bucket: This is not a recommended solution to the issue, as it goes against the purpose of using CloudFront. By restricting access to only a specific IAM user, you are limiting the benefits of CloudFront, such as improved performance and reduced latency. This solution also requires more management overhead to maintain the access controls for individual users. Therefore, this is not the recommended solution to remediate the issue.

In summary, to remediate the issue of users bypassing the CloudFront distribution, you should create a CloudFront OAI and update the S3 bucket policy to allow access only from the OAI's identity. This will ensure that requests coming from the CloudFront distribution can access objects in the S3 bucket, while direct requests to the S3 bucket will be denied.