CloudFront Custom Domain SSL and S3 Origin Access

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

AD Use AWS Certificate Manager (ACM) to create a public certificate in the us-east-1 Region for CloudFront and configure Amazon S3 to allow uploads from CloudFront Origin Access Control (OAC).

Question

A company hosts an application on AWS. The application gives users the ability to upload photos and store the photos in an Amazon S3 bucket. The company wants to use Amazon CloudFront and a custom domain name to upload the photo files to the S3 bucket in the eu-west-1 Region. Which solution will meet these requirements? (Choose two.)
  1. Use AWS Certificate Manager (ACM) to create a public certificate in the us-east-1 Region. Use the certificate in CloudFront. Correct Answer
  2. Use AWS Certificate Manager (ACM) to create a public certificate in eu-west-1. Use the certificate in CloudFront.
  3. Configure Amazon S3 to allow uploads from CloudFront. Configure S3 Transfer Acceleration.
  4. Configure Amazon S3 to allow uploads from CloudFront origin access control (OAC). Correct Answer
  5. Configure Amazon S3 to allow uploads from CloudFront. Configure an Amazon S3 website endpoint.

Key Takeaways

The question tests the specific constraint that CloudFront requires public SSL/TLS certificates for custom domains to be provisioned exclusively in the us-east-1 Region, regardless of the origin's location.

This page explains how to configure Amazon CloudFront with a custom domain name for an S3 origin, focusing on the strict requirement for ACM certificates in us-east-1 and the use of Origin Access Control (OAC) for secure uploads.

Common mistake: Many candidates incorrectly assume they should create the certificate in the same region as the S3 bucket (eu-west-1) or believe OAC cannot support upload scenarios, leading them to choose options like B or C.

Expert Analysis

Why the Answer Is Correct

Option A is correct because AWS CloudFront requires all public SSL/TLS certificates used with custom domain names to be created and stored in the US East (N. Virginia) Region (us-east-1). This is a global service constraint, meaning even if your origin (S3) is in eu-west-1, the certificate must reside in us-east-1. Option D is correct because Origin Access Control (OAC) is the modern and recommended method for restricting access to an S3 bucket from CloudFront. It allows you to securely grant CloudFront permission to read from (and in this context, facilitate uploads via associated services or direct PUT operations if configured correctly) the bucket without exposing it publicly.

Why the Other Options Are Wrong

Option B is incorrect because ACM certificates for CloudFront custom domains cannot be created in regions other than us-east-1; attempting to do so will fail or result in an invalid configuration for HTTPS. Option C mentions S3 Transfer Acceleration, which optimizes transfer speeds over long distances but does not inherently solve the security/identity requirement for allowing CloudFront to act as the uploader; furthermore, it doesn't address the certificate region issue. Option E suggests using an S3 website endpoint, which is designed for serving static websites via HTTP/HTTPS directly to browsers, not for private API-style uploads from CloudFront origins, and lacks the necessary access control mechanisms.

Community Comment Notes

The community consensus strongly supports AD, with multiple users noting that "CloudFront requires the certificate to be in the us-east-1 Region." Some learners expressed confusion regarding whether OAC supports uploads, with one user stating "OAC do not support uploads," but this is a misconception; OAC controls access, and while traditionally associated with GET requests, it is the correct mechanism for securing the origin connection. Others incorrectly suggested BD, failing to recognize the regional certificate constraint.

Official Reference

https://docs.aws.amazon.com/acm/latest/userguide/certificates.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always remember that CloudFront is a global edge service. When dealing with SSL/TLS certificates for custom domains, the region is always us-east-1, regardless of where your backend resources are located.

Frequently Asked Questions

Why can't I create the CloudFront SSL certificate in eu-west-1?

CloudFront is a global service. For public certificates associated with custom domain names, AWS mandates that they be provisioned in the us-east-1 Region only.

Does Origin Access Control (OAC) support uploads to S3?

Yes. OAC restricts access to the S3 bucket so that only CloudFront can access it. While often used for downloads, it secures the origin for any authorized interaction, including uploads if the application logic permits.

More SAA-C03 FAQ →

Community Votes

AD
100%

100% of anonymous learners picked answer AD. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. JoeTromundo 👍 9
    Amazon CloudFront requires an SSL/TLS certificate to use HTTPS with a custom domain name. This certificate MUST be provisioned in the us-east-1 Region, regardless of where your content is hosted. This is because CloudFront only supports certificates in the us-east-1 Region for use with custom domain names. Origin Access Control (OAC) is a feature that allows you to securely upload content to an S3 bucket using CloudFront. It provides fine-grained access control and ensures that only CloudFront can upload files to the S3 bucket, preventing direct access. Configuring S3 to allow uploads from CloudFront using OAC ensures that only CloudFront can interact with the S3 bucket, adding an extra layer of security.
  2. [Removed] 👍 3
    A. Use AWS Certificate Manager (ACM) to create a public certificate in the us-east-1 Region. Use the certificate in CloudFront. CloudFront requires that the SSL/TLS certificate for the custom domain be created in the us-east-1 Region (N. Virginia). Even if your S3 bucket is in another region, the certificate must be in us-east-1 because CloudFront is a global service and this region is where CloudFront looks for certificates. D. Configure Amazon S3 to allow uploads from CloudFront origin access control (OAC). Configuring S3 to allow uploads from CloudFront using Origin Access Control (OAC) ensures that only CloudFront can interact with your S3 bucket, improving security by preventing direct access to the bucket from the public internet.
  3. dhewa 👍 3
    A. Use AWS Certificate Manager (ACM) to create a public certificate in the us-east-1 Region. Use the certificate in CloudFront: CloudFront requires the certificate to be in the us-east-1 Region for custom domain names. D. Configure Amazon S3 to allow uploads from CloudFront origin access control (OAC): This ensures secure uploads from CloudFront to the S3 bucket.
  4. TicDcNess 👍 2
    AWS Region for AWS Certificate Manager To use a certificate in AWS Certificate Manager (ACM) to require HTTPS between viewers and CloudFront, make sure you request (or import) the certificate in the US East (N. Virginia) Region (us-east-1)
  5. rpmaws 👍 2
    cloud front require all SSL certificate to be in us-east region regardless the origin location of the site server.
Show 4 more comments
  1. yangbo 👍 1
    OAC do not support uploads from CloudFront to the S3 bucket.
  2. George1990 👍 6
    Correct is BD
  3. JunsK1e 👍 4
    BD correct answer
  4. komorebi 👍 4
    Answer is AD

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide