SAA-C03 Q482 · Security

Question

A solutions architect must design a solution that uses Amazon CloudFront with an Amazon S3 origin to store a static website. The company’s security policy requires that all website traffic be inspected by AWS WAF. How should the solutions architect comply with these requirements?

Accepted Answer

Answer D satisfies both requirements:

**Requirement 1: CloudFront with S3 origin for static website**
- An **Origin Access Identity (OAI)** is a special CloudFront identity that you associate with your distribution. You then update the S3 bucket policy to grant access only to the OAI, ensuring users cannot bypass CloudFront and access S3 directly.
- This creates a clean architecture: Users → CloudFront → S3 (via OAI).

**Requirement 2: All traffic must be inspected by AWS WAF**
- AWS WAF can be **natively associated with CloudFront distributions**. When you enable AWS WAF on the CloudFront distribution, every incoming request is evaluated against your WAF rules before CloudFront serves or fetches content.
- Since OAI ensures the ONLY way to reach S3 is through CloudFront, and WAF inspects

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips