A developer is testing a new file storage application that uses an Amazon CloudFront distribution to serve content from an Amazon S3 bucket. The distribution accesses the S3 bucket by using an origin access identity (OAI). The S3 bucket's permissions explicitly deny access to all other users. The application prompts users to authenticate on a login page and then uses signed cookies to allow users to access their personal storage directories. The developer has configured the distribution to use its default cache behavior with restricted viewer access and has set the origin to point to the S3 bucket. However, when the developer tries to navigate to the login page, the developer receives a 403 Forbidden error. The developer needs to implement a solution to allow unauthenticated access to the login page. The solution also must keep all private content secure. Which solution will meet these requirements?
Select one answer.
Marked answer: A
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose A2
A) Adding a second cache behavior allows you to define specific rules for the login page while keeping the default settings for private content unchanged. B) Eliminated - Changing the default cache behavior to allow unrestricted access to the login page affects other private content, potentially compromising security. D) Eliminated - Adding a bucket policy to allow public access to the login page directly contradicts the requirement to use CloudFront for secure content delivery.
Chose A1
A is the correct answer.
1
Answer is A. --The original way the developer had designed this application was too restrictive and didn't allow someone to even authenticate to get a signed cookie. By caching the second behavior, it allows the person authenticating to retrieve a cookie to access their personal data.
