A media company streams video from a private S3 bucket through a CloudFront distribution. The bucket uses KMS encryption. The team wants direct requests to the bucket endpoint to fail unless they come from that distribution, signed with SigV4. Which setup achieves this?
Show answer and explanation
Answer: C
Origin Access Control signs origin requests to S3 with SigV4 and supports SSE-KMS encrypted buckets. A bucket policy that grants s3:GetObject only when aws:SourceArn equals the distribution ARN denies direct bucket access. OAC is the current replacement for the older Origin Access Identity approach.
Why the other options are wrong
- A. Origin Access Identity is the older mechanism. It does not sign requests with SigV4 or support KMS-encrypted buckets the way OAC does.
- B. Signed cookies are a viewer-side access control feature, and a public-read ACL would expose the objects directly, which defeats the goal.
- D. Field-level encryption protects selected form fields between the viewer and origin. It does not restrict who can read objects from the bucket.