Implement the token check in a CloudFront Function with CloudWatch logging and continuous deployment

Why the Answer Is Correct

The solution must validate an authorization token at the edge so that CloudFront and Amazon S3 are both protected from direct access, must log the token-check activity to Amazon CloudWatch, and must support regular rolling updates of the checking code, all with the least operational effort. CloudFront Functions are a lightweight JavaScript runtime that executes at the CloudFront edge, which is exactly where the signed URL and its token arrive, so implementing the token check there validates the request before CloudFront serves any content and keeps origin access restricted (B). CloudFront Functions support CloudWatch logging, satisfying the logging requirement (B). For updates, CloudFront continuous deployment performs rolling deployments of the function code to the distribution without the team having to stand up parallel infrastructure, which is what the regular rolling update requirement calls for (B). f4b18ba identified CloudFront Functions as the lightweight, low-latency environment ideal for simple tasks such as authorization checks, and Srikantha noted the approach checks the token directly at the edge, minimizing latency, and integrates with CloudWatch logging and continuous deployment. uncledana confirmed it provides the least operational overhead. B is the correct answer.

Why the Other Options Are Wrong

A implements the authorization token check in Lambda@Edge. matt200's assessment of Lambda@Edge is accurate on the capabilities, since it can perform token authorization checks, supports CloudWatch logging, handles more complex validation logic, integrates with CloudFront, and supports rolling updates via CloudFront continuous deployment. Its weakness is operational: Lambda@Edge functions must be replicated across Regions, run on the Node.js or Python runtime, and provide capabilities beyond what a token check requires. As f4b18ba framed it, CloudFront Functions is the lightweight JavaScript-based environment designed for high performance with low latency and is ideal for simple tasks like authorization checks, so the least-operational-effort requirement points to B. C implements the check in application code installed on the EC2 instances and adds CloudWatch logging through the CloudWatch agent, then creates a second CloudFront distribution and migrates traffic with Route 53 weighted routing. Putting the check in the origin application fails the core security requirement, because a check at the origin does not prevent requests from bypassing CloudFront and reaching S3 directly. D uses CloudFront Functions for the check, which is the correct runtime, but achieves the rolling update by creating a second CloudFront distribution and shifting traffic with Route 53 weighted routing, duplicating the entire distribution and adding DNS-based traffic management where CloudFront continuous deployment would simply roll the function code, so D carries substantially more operational overhead than B. B is correct.

Community Comment Notes

Community voted B (88), with A a minority (12). f4b18ba identified CloudFront Functions as a lightweight JavaScript-based environment running at the edge, designed for high performance with low latency and ideal for simple tasks such as authorization checks. Srikantha explained that it checks the token directly at the edge, minimizing latency, and integrates seamlessly with CloudWatch logging and continuous deployment. uncledana confirmed it provides the least operational overhead across token validation, CloudWatch logging, and rolling updates. matt200 was the sole dissenter, favoring Lambda@Edge and citing its suitability for token authorization, CloudWatch logging, complex validation logic, CloudFront integration, and rolling updates; while each capability is accurate, Lambda@Edge carries additional operational cost for a simple token check, which is the decisive factor given the requirement. No alternative received majority support.