Which solution will meet these requirements?

By:
In: DVA-C01
Tagged:
With: 1 Comment
A developer is testing a new file storage application that uses an Amazon CloudFront distribution to serve content from an Amazon S3 bucket.The distribution accesses the S3 bucket by using an origin access identity (OAI).The S3 bucket’s permissions explicitly deny access to all other users.The application prompts users to authenticate on a login page and then uses signed cookies to allow users to access their personal storage directories.The developer has configured the distribution to use its default cache behavior with restricted viewer access and has set the origin to point to the S3 bucket.However, when the developer tries to navigate to the login page, the developer receives a 403 Forbidden error.The developer needs to implement a solution to allow unauthenticated access to the login page.The solution also must keep all private content secure.

Which solution will meet these requirements?

Add a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern for the second cache behavior to the path of the login page, and make viewer access unrestricted. Keep the default cache behavior’s settings unchanged.

Add a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern for the second cache behavior to *, and make viewer access restricted. Change the default cache behavior’s path pattern to the path of the login page, and make viewer access unrestricted.

Add a second origin as a failover origin to the default cache behavior. Point the failover origin to the S3 bucket. Set the path pattern for the primary origin to * and make viewer access restricted. Set the path pattern for the failover origin to the path of the login page, and make viewer access unrestricted.

Add a bucket policy to the S3 bucket to allow read access. Set the resource on the policy to the Amazon Resource Name (ARN) of the login page object in the S3 bucket. Add a CloudFront function to the default cache behavior to redirect unauthorized requests to the login page’s S3 URI.

Explanations:

Adding a second cache behavior for the login page allows unrestricted access for the login page while keeping the default cache behavior for private content with restricted access.

Changing the default cache behavior’s path pattern to the login page would block access to other content and does not fulfill the requirement of restricted access to private content.

Adding a failover origin is not necessary here since only the login page needs unrestricted access, and the content should be served from the same origin.

Modifying the bucket policy to allow read access for the login page object contradicts the security model of using the OAI to restrict access. A CloudFront function isn’t needed for this scenario.

2025-09-30

1 Comment

  1. Janet
    Author

    If I had to guess, I’d say the answer is:
    Add a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern for the second cache behavior to the path of the login page, and make viewer access unrestricted. Keep the default cache behavior’s settings unchanged.

Leave a Reply

Your email address will not be published. Required fields are marked *

eight + 1 =