Welcome back and time for a new question.
So let's just jump in and get started straightaway.
This is the question we're going to be looking at
in this lesson.
The question is you've been asked to design a system
for the secure viewing and distribution
of medical imaging data.
The platform stores images of various sizes on S3
and caches them globally using CloudFront
for delivery to customers.
All behaviors have trusted signers added,
but you found out that customers
can still access the data without authentication.
And this is unacceptable for sensitive data.
What option should you suggest?
And the question indicates to choose on.
Now as before, we need to do some keyword identification
and highlight what matters for the scenario
and potentially what can influence answer selection.
So let's do that first.
And as always, if you want to try this first,
then go ahead, pause the video,
take the time to review the question yourself
and then resume when you're ready to compare.
Okay, so this is what I've identified in the question.
What we know is that the platform stores images
and it stores these images in S3
and then it cashes them using CloudFront.
We don't at this stage have any knowledge
of the configuration at the S3 bucket.
And that's important to selecting an answer.
If the question stated any specific permissions
via bucket policies,
then that would at least give us some idea.
But at this stage we don't know any of that,
but maybe the answers will provide
some additional information, maybe not.
What we also know is that the CloudFront distribution
has multiple behaviors and they all have trusted signers,
which have been added.
Now, this is actually a key word
to specifically look out for in the exam.
It means that the behavior has been configured
to be private,
meaning that pre-signed URLs or cookies
are required to access objects,
which are cached by the platform.
Finally, at the bottom we're told
that customers can access data without authentication.
And this is massively important
because it seems on the surface to conflict
with the trusted signers point earlier in the question.
If a behavior is set to be private,
this means it needs signed URLs or cookies to access it.
But if the data can still be accessed,
then that points to a misconfiguration
that we need to identify or resolve.
Now how did you compare
with what I've identified in this question?
Did you get to similar sets of keywords?
If so, awesome.
If not, then just keep refining your skills
as you go through this set of lessons.
But now it's time to review the answers.
So let's quickly look at how many answers we have
and exactly what each of them looks like.
So we've got a total of four answers to this question.
Once again, the first step
is to review the answers, looking for key words
or anything of significance based on the question.
So go ahead, pause the video, review the answers yourself.
And then in a few moments, you can compare with what I find.
Okay, so now let's look at what I identified
in the answers
and you can compare with anything that you identified.
Now these are the key elements
which I identified in the answers.
And to save time, let's jump straight into the answers
and evaluate what about them
makes them valid versus invalid.
And we're going to start with a top answer.
Now this answer suggests
that we add an S3 bucket policy
to restrict access to the AWS or web identities attempting
to access the booklet.
Now, the problem here is twofold.
First, the question is stating that customers
are accessing the system using CloudFront.
So any answer which mentions S3
you have to be immediately critical of,
don't exclude it, but treat it with a little bit of caution.
The answer also talks about adding web identities
to the bucket policy.
And that's not something that you can do natively.
Bucket policies are used
to either grunt open access
or to add specific AWS identities.
You can't natively add web identities
without using web identity Federation.
And that's not mentioned in the question.
And so I'm going to exclude this top answer.
Now the second answer is actually a tricky one.
It says, to change the CloudFront distribution
to be private preventing any on authenticated access
to the S3 buckets.
And there are three things wrong with this answer.
The first is that it States a CloudFront distribution.
This isn't the thing that set to private or not.
You learned in the theory lessons
that configuring parts of CloudFront
to be private or restricted
is something configured on a behavior within a distribution.
So not the distribution itself.
Secondly, the question tells us that trusted signers
have been added already.
And this means the behaviors are already private
and third, even if all of this were true,
this wouldn't actually prevent direct access
to the content using S3.
CloudFront and S3 separate products.
CloudFront being private via trusted signers
doesn't impact the ability to access S3 directly.
You can still bypass CloudFront
unless you make specific configuration changes.
And so we're eliminating this answer as well.
Now, the reason why this answer is wrong,
it actually also shows us what the right answer is,
but more on this in a second.
the last answer suggests using SSE-KMS on the S3 buckets
and then to restrict the CMK or customer master key
to the web identities who require access.
Now, this one is just wrong.
SSE-KMS is a server side encryption feature.
Also as with bucket policies restricting
the CMK to web identities,
isn't something that it's designed for,
and so this answer needs to be excluded.
This leaves us with answer three,
which is the correct answer, but we need to know why.
The answer suggests creating an OAI,
which has an Origin Access Identity,
or updating the distribution,
and then adding a bucket policy.
The problem, the question scenario details
is that they've configured a CloudFront distribution.
They've used an S3 origin and configured the behaviors
to be private by adding trusted signers.
This means access via CloudFront is restricted,
but nothing about this prevents people
going directly to S3 and bypassing that restriction.
And Origin Access Identity is a virtual identity,
which can be assigned to a CloudFront distribution.
Once done the bookie policies can be configured
to only allow access from that identity.
That means all access to data within the S3 bucket
has to come via CloudFront.
And because CloudFront is configured to be restricted,
any accesses to that S3 bucket via CloudFront
have to conform to the restrictions
placed on that distribution and any of its behaviors.
So hope that made sense, It's a foreign question.
It just takes practice to start identifying
what a question scenario means,
and then that allows you to select the right answer.
Now don't worry if you find this difficult at first,
there are many more questions that you can practice with
in this section of the course.
You just need to keep refining your skills,
keep practicing these questions.
And by the time you make it
to the full practice exams later in the section,
as well as the full certification exam,
you should have got the hang of it.
At this point though, thanks for watching,
go ahead complete this lesson and when you're ready,
I'll look forward to you joining me in the next.