Serving Private S3 Content with Least Administrative Effort

SOA-C03 By islever Editorial Last updated

Identify and remediate issues by using monitoring and availability metrics. Implement and manage security and compliance tools and policies.

Short answer

B Create an Amazon CloudFront distribution with Origin Access Control to securely serve private S3 objects without exposing them publicly.

Question

A company's website runs on an Amazon EC2 Linux instance. The website needs to serve PDF files from an Amazon S3 bucket. All public access to S3 bucket is blocked at the account level. The company needs to allow website users to download the PDF files.
Which solution will meet these requirements with the LEAST administrative effort?
  1. Create an IAM role that has a policy that allows s3:list and s3:get permissions. Assign the role to the EC2 instance. Assign a company employee to download requested PDF file to the EC2 instance and to deliver the files to website users. Create an AWS Lambda function to periodically delete local files.
  2. Create an Amazon CloudFront distribution that uses an origin access control (OAC) that points to the S3 bucket. Apply a bucket policy to the bucket to allow connections from the CloudFront distribution. Assign a company employee to provide a download URL that contains the distribution URL and the object path to users when users request PDF files. Correct Answer
  3. Change the S3 bucket permissions to allow public access on the source S3 bucket. Assign a company employee to provide a PDF file URL to users when users request the PDF files.
  4. Deploy an EC2 instance that has an 1AM instance profile to a public subnet. Use a signed URL from the EC2 instance to provide temporary access to the S3 bucket for website users.

Key Takeaways

The core trap is prioritizing technical elegance over operational efficiency; while presigned URLs are valid, the requirement for 'least administrative effort' combined with explicit manual intervention in other options makes the automated CloudFront OAC pattern the superior choice.

This question explores secure methods for serving private Amazon S3 objects, contrasting manual processes with automated solutions like CloudFront Origin Access Control (OAC) and presigned URLs to determine the option requiring the least administrative effort.

Common mistake: Candidates often choose Option D (Presigned URLs via EC2) because it is a standard security pattern for temporary access. However, they overlook that Option B's CloudFront solution is fully automated after initial setup, whereas Option D relies on an EC2 instance generating tokens and Option A/B/C involve significant manual steps or policy violations.

Expert Analysis

Why the Answer Is Correct

Option B is the correct answer because it implements the standard AWS architectural pattern for serving private content via CloudFront using Origin Access Control (OAC). This allows the S3 bucket to remain strictly private (respecting the account-level public access block) while automatically handling caching, delivery, and authentication. Although the prompt includes a distracting clause about an employee providing URLs, this phrasing appears in multiple options as a distractor; the key differentiator is that CloudFront OAC requires zero ongoing administrative effort to maintain access, unlike manual downloads or instance-based token generation.

Why the Other Options Are Wrong

Option A is operationally unviable as it requires a human employee to manually download and deliver files, creating a massive bottleneck and security risk. Option C directly violates the requirement to keep public access blocked at the account level. Option D involves deploying an EC2 instance solely to generate presigned URLs; this introduces unnecessary infrastructure management overhead compared to the serverless, edge-cached nature of CloudFront.

Community Comment Notes

Community consensus strongly favors Option B, recognizing CloudFront OAC as the industry-standard low-effort solution. Comments highlight that Options A and C involve unacceptable manual labor or security violations. While some users initially leaned toward D due to its technical validity for temporary access, they ultimately agreed that B offers the best balance of security and automation, noting that the 'employee' text in the options was likely a poorly worded distractor rather than a strict operational constraint.

Exam Strategy

When evaluating 'least administrative effort' questions, prioritize managed services (like CloudFront) over custom implementations (like EC2 scripts). Always check if a solution violates a hard constraint (like 'public access blocked'); if so, discard it immediately regardless of its other merits.

Frequently Asked Questions

Why is Option D not the best answer?

While presigned URLs are secure, managing an EC2 instance to generate them adds administrative overhead. CloudFront OAC is a managed service that handles delivery and caching automatically.

Does CloudFront OAC allow public access?

No. OAC ensures that only CloudFront can access the private S3 bucket. End-users download from CloudFront, but the underlying S3 bucket remains completely private and protected by the account-level block.

More SOA-C03 FAQ →

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Derel1ct 👍 2 Answered D
    This question definitely has some typos in it. That being said, literally A., B., and C. all have some poor sap at your company providing the URL to files manually. This may genuinely be the funniest question I've ever seen asked.
  2. imtiaz01 👍 1 Answered B
    A CloudFront distribution with origin access control (OAC) is the standard pattern for serving S3 objects while keeping the bucket fully private. OAC lets CloudFront authenticate to the bucket; a bucket policy allows only that distribution to read the objects. Public access stays blocked at the account level, and users download the PDFs through the CloudFront URL. Once it’s set up, it runs itself — least ongoing administrative effort. Why not the others: A puts a human in the loop manually fetching and delivering files, plus a Lambda janitor — the opposite of low effort, and not scalable. C requires turning off public access blocking (violates the requirement) and is a security anti-pattern. D an EC2-generated signed URL could work mechanically, but you’re maintaining instance and signing logic yourself; CloudFront + OAC is the managed, lower-effort answer. The “employee provides a URL” wording in B is a bit of a distractor — the real point is that OAC keeps the bucket private while serving the files, which is what the question is testing.
  3. 046e32c 👍 1 Answered D
    Has typos in it which can be confusing, but D is the answer... Use Amazon S3 presigned URLs. Attach an IAM role to the EC2 instance that grants read access to the S3 bucket objects. The website application generates presigned URLs for the PDF files and gives those URLs to users to download. This works because the bucket can remain private and public access can stay blocked, while users get temporary authorized access to specific PDF objects.
  4. imtiaz01 👍 1 Answered B
    B CloudFront with OAC is the standard, low-effort way to securely serve S3 content while keeping the bucket private (account-level public access blocked stays intact). C violates the public access block, A and D require ongoing manual/operational effort.
  5. Atown 👍 1 Answered B
    However, B has a stronger argument for least administrative effort because D explicitly requires deploying and managing another EC2 instance, despite the company already having an EC2 web server.
Show 1 more comment
  1. alfabika 👍 1 Answered D
    I man assign an employee is not a good idea, presigned URLs is the way to solved the issue

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Resolving Private IPv4 Exhaustion in AWS VPCs

S-grade

How Do You Ramp ALB Traffic Gradually During EC2 Cache Warm-Up?

S-grade

Avoiding Permanent Credentials with AWS STS

S-grade

Automate EC2 Reboot with Systems Manager Maintenance Windows

S-grade

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide