Purpose of This Lesson

This hands-on lesson demonstrates how to publish an Amazon S3-hosted website through Amazon CloudFront while preventing direct public access to the S3 origin. The workflow also configures a custom domain with Amazon Route 53, HTTPS using AWS Certificate Manager (ACM), and a default root object so visitors can load the site without explicitly entering index.html.

Because this lesson is part of AWS Certified CloudOps Engineer Associate SOA-C03 preparation, focus on recognizing the security and routing decisions involved: use CloudFront as the public entry point, keep the S3 bucket private, authorize CloudFront with Origin Access Control (OAC), and use the correct certificate region for CloudFront.

Key Concepts

• CloudFront distribution: The public content-delivery layer that receives viewer requests and retrieves content from the origin.
• Amazon S3 origin: The bucket stores the website content, including index.html.
• Origin Access Control (OAC): The CloudFront-to-S3 authentication mechanism used to access a private S3 bucket.
• Private S3 origin: The bucket should not be publicly readable. CloudFront receives permission through the bucket policy created or updated as part of the OAC configuration.
• Default root object: Setting index.html allows the distribution domain or custom domain to serve the homepage without requiring /index.html in the URL.
• Alternate domain name: A custom hostname, such as DCTAWS.com, associated with the CloudFront distribution.
• ACM certificate: The TLS certificate used to serve the custom domain over HTTPS. For CloudFront, the certificate must be available in the US East region.
• Route 53 alias record: A DNS record that maps the custom domain to the CloudFront distribution.
• Viewer protocol policy: A CloudFront behavior setting that can redirect HTTP requests to HTTPS.

Protected Origin Configuration Workflow

1. Create and populate the S3 bucket

Create a dedicated S3 bucket for the lab and upload the supplied index.html file to the bucket root. The example page confirms that the website is being securely accessed through CloudFront.

The important security decision is not to make the bucket publicly accessible. The bucket will be accessed through CloudFront using OAC.

2. Create the CloudFront distribution

When creating the distribution:

1. Select Amazon S3 as the origin type.
2. Choose the S3 bucket.
3. Leave Origin path empty because index.html is stored at the root of the bucket.
4. Use the recommended private S3 access setting.
5. Allow CloudFront to create and use an Origin Access Control.
6. Do not enable AWS WAF protections in this particular configuration step; WAF is handled in a later lesson.

OAC establishes the trusted relationship between CloudFront and S3. CloudFront can retrieve objects, while direct anonymous access to the bucket remains blocked.

3. Configure the custom domain and certificate

The distribution can use a custom domain as an alternate domain name. In the lab, the custom domain is DCTAWS.com.

CloudFront requires an ACM certificate covering the custom domain. The certificate must be in US East for CloudFront. The workflow can create a wildcard certificate, validate it through Route 53, and update the hosted-zone records as needed.

The certificate must cover the exact hostname that viewers use. A wildcard certificate can cover matching subdomains, but the domain configuration and certificate coverage still need to be checked before deployment.

4. Set the default root object

Set the distribution’s default root object to:

index.html

This makes a request to the distribution hostname or custom domain resolve to the homepage automatically. Without this setting, a request to the domain root may not automatically return the intended S3 object.

5. Verify the OAC and S3 bucket policy

After the distribution is created, inspect the origin settings and confirm that OAC is associated with the S3 origin. The S3 bucket policy should allow CloudFront to perform the required object access, with a condition tying the request to the relevant CloudFront distribution or OAC configuration.

The key relationship is:

Viewer -> CloudFront -> OAC-authenticated request -> Private S3 bucket

A viewer should not be able to bypass CloudFront by requesting the S3 origin directly.

6. Wait for deployment and test the distribution

CloudFront distribution deployment takes several minutes. Wait until the distribution is active before testing.

Test both:

• The CloudFront distribution domain name.
• The custom domain over HTTPS, such as https://DCTAWS.com.

The expected result is that CloudFront renders the index.html content while the S3 bucket remains protected from direct public access.

7. Create the Route 53 alias record

Create an A record in the Route 53 hosted zone and configure it as an alias to the CloudFront distribution. Once DNS has propagated, the custom domain resolves to CloudFront rather than directly to S3.

Exam- or Assessment-Relevant Takeaways

• For a private S3 origin behind CloudFront, select Origin Access Control rather than exposing the bucket publicly.
• The CloudFront distribution is the public access layer; the S3 bucket is the protected origin.
• A CloudFront ACM certificate must be in US East.
• Set the default root object to index.html when the homepage is stored at the bucket root and should load from the domain root.
• Use a Route 53 alias record to point the custom domain to the CloudFront distribution.
• A viewer protocol policy that redirects HTTP to HTTPS improves transport security for viewer requests.
• CloudFront distribution changes, including default root object updates, can require deployment time before they become active.
• Disabling a distribution is not the same as deleting it. To remove it, disable it first, wait until the disabled state is complete, and then delete it.
• AWS WAF is a separate protection capability. It was intentionally left for a later configuration step in this lab.

Tool / Feature Decision Guide

Requirement	Appropriate choice	Reason
Deliver S3 content through a global edge service	CloudFront distribution	CloudFront is the viewer-facing distribution and content-delivery layer.
Keep the S3 bucket nonpublic while allowing CloudFront access	Origin Access Control	OAC authenticates CloudFront’s requests to the S3 origin.
Serve a homepage at the domain root	Default root object: index.html	Requests to the root can resolve to the specified object.
Use a branded hostname	CloudFront alternate domain name plus ACM certificate	The distribution can serve the custom hostname over HTTPS.
Map the custom hostname to CloudFront	Route 53 alias A record	The alias targets the CloudFront distribution.
Protect viewer connections with TLS	HTTPS and a viewer protocol policy redirecting HTTP	HTTP requests can be redirected to HTTPS.
Add web application filtering	AWS WAF	WAF is a separate feature and was deferred to another lesson.
Remove a temporary distribution	Disable, wait, then delete	CloudFront distributions must be disabled before deletion.

Common Traps / Misconceptions

• Making the S3 bucket public for CloudFront: This defeats the protected-origin design. Use OAC and the associated bucket policy instead.
• Using an S3 website endpoint as though it were a private S3 origin: The lab selects the S3 bucket as an Amazon S3 origin and uses OAC for access control. Do not assume every S3 endpoint supports the same private-origin behavior.
• Forgetting the ACM certificate region: A certificate that is not available in US East will not satisfy the CloudFront custom-domain configuration.
• Confusing the distribution domain with the custom domain: The CloudFront-generated domain can work before DNS is configured, while the custom domain requires the alternate domain, certificate, and Route 53 record.
• Omitting the default root object: The distribution may not automatically serve the intended homepage at / unless index.html is configured.
• Testing before deployment finishes: A distribution can remain in a deploying state for several minutes. Validate after it becomes active.
• Assuming a Route 53 record alone protects the origin: DNS directs normal users to CloudFront, but origin protection depends on S3 permissions and OAC.
• Assuming disable means delete: A distribution must be disabled and then deleted as separate operations.
• Treating WAF as part of OAC: OAC controls CloudFront’s access to the S3 origin; WAF provides a separate web-request filtering capability.

Real-World Engineer / Analyst Notes

• Inspect both sides of the trust relationship: CloudFront’s origin configuration and the S3 bucket policy. A mismatch can produce access failures even when the distribution exists.
• Keep the origin path aligned with the object layout. If the content is stored at the bucket root, leave Origin path empty; otherwise, requests may be directed to the wrong location.
• Test the distribution hostname before troubleshooting Route 53. This separates CloudFront or S3 problems from DNS and certificate problems.
• Confirm that the custom domain, certificate coverage, and Route 53 hosted zone all refer to the same intended hostname.
• Treat deployment status as operational state, not merely a creation detail. Configuration changes are not ready for validation until CloudFront finishes deploying them.
• For temporary labs, clean up deliberately. Disable the distribution, wait for the disabled state, and then delete it to avoid leaving unnecessary resources running.
• CloudFront provides the protected access path, but it does not by itself prove that the S3 origin is inaccessible. Verify the bucket’s public-access posture and policy as part of validation.

Quick Reference Summary

S3 bucket: private
Content: index.html at bucket root
CloudFront origin: Amazon S3 bucket
Origin authentication: Origin Access Control
Default root object: index.html
Viewer access: HTTPS through CloudFront
Certificate: ACM certificate in US East
Custom DNS: Route 53 alias A record -> CloudFront distribution
Optional web filtering: AWS WAF
Cleanup: disable -> wait -> delete

The protected request path is:

Client -> HTTPS custom domain -> Route 53 alias -> CloudFront -> OAC -> private S3 object

Flashcards

Q: A website is stored in S3, but the bucket must not be publicly readable. Which CloudFront feature should provide origin authentication?
A: Use CloudFront Origin Access Control (OAC). It allows CloudFront to authenticate to the private S3 origin without requiring public bucket access.

Q: When should the CloudFront Origin path be left empty in this configuration?
A: Leave it empty when the requested content, including index.html, is stored at the root of the S3 bucket.

Q: Which default root object should be configured for the lab website, and what does it accomplish?
A: Configure index.html. CloudFront can then serve that object when the viewer requests the distribution or custom domain root without adding /index.html.

Q: A custom domain is being added to CloudFront, but ACM cannot find a suitable certificate. What region should be checked first?
A: Check US East. CloudFront requires its ACM certificate to be available in the US East region.

Q: What DNS record directs the custom domain to a CloudFront distribution in Route 53?
A: Create an alias A record targeting the CloudFront distribution.

Q: What is the security difference between using CloudFront as the public entry point and making the S3 bucket public?
A: CloudFront can serve the content while OAC authorizes its requests to S3. Making the bucket public would allow users to bypass CloudFront and access the origin directly.

Q: Which settings must work together for a custom HTTPS hostname?
A: The CloudFront alternate domain name, an ACM certificate covering that hostname in US East, and a Route 53 record pointing the hostname to CloudFront must align.

Q: When would you test the CloudFront-generated distribution domain before testing the custom domain?
A: Test it first to isolate distribution and origin behavior from DNS, custom-domain, and certificate configuration issues.

Q: What viewer protocol behavior is recommended for this protected website?
A: Redirect HTTP requests to HTTPS using the CloudFront viewer protocol policy.

Q: How does OAC relate to the S3 bucket policy?
A: OAC identifies the CloudFront access mechanism, while the S3 bucket policy grants the required object access to CloudFront under the appropriate condition.

Q: A CloudFront distribution is still deploying after a configuration change. What is the operational implication?
A: Wait until the distribution becomes active before treating the change as ready for validation; deployment can take several minutes.

Q: Is AWS WAF required to configure the protected S3 origin in this lesson?
A: No. WAF is a separate security feature and was deferred to a later lesson; OAC is the feature protecting the S3 origin here.

Q: What is the correct cleanup order for a temporary CloudFront distribution?
A: Disable the distribution, wait for it to reach the disabled state, and then delete it.

Practice Questions

Question 1

A team wants to serve an S3-hosted website through CloudFront. The security requirement states that users must not be able to access the S3 bucket directly. Which configuration best meets the requirement?

A. Enable public read access on the bucket and use CloudFront caching
B. Configure CloudFront with OAC and keep the bucket private
C. Create a Route 53 alias directly to the S3 bucket and omit CloudFront
D. Upload the content to CloudFront instead of S3

Correct answer: B

Explanation: OAC allows CloudFront to authenticate to the private S3 origin. Public bucket access would permit bypassing CloudFront.

Question 2

A CloudOps engineer adds DCTAWS.com as a CloudFront alternate domain name, but the console reports that no suitable ACM certificate is available. Which issue should be investigated first?

A. Whether the S3 bucket has versioning enabled
B. Whether index.html is at the bucket root
C. Whether the certificate covering the domain is in US East
D. Whether the Route 53 record is a CNAME instead of an alias

Correct answer: C

Explanation: The decisive clue is the CloudFront certificate requirement. The ACM certificate used by CloudFront must be available in US East.

Question 3

Users can load the CloudFront distribution domain only when they append /index.html. The file exists at the root of the S3 bucket. What should be changed?

A. Set the CloudFront default root object to index.html
B. Add an Origin path of /index.html
C. Make the S3 bucket publicly readable
D. Replace the Route 53 alias with an MX record

Correct answer: A

Explanation: The default root object maps requests to the domain root to index.html. The object is already at the bucket root, so an Origin path is unnecessary.

Question 4

A custom domain should resolve to CloudFront, and the CloudFront distribution is already active with a valid certificate. Which Route 53 configuration is appropriate?

A. An alias A record targeting the CloudFront distribution
B. An MX record targeting the CloudFront distribution
C. A TXT record containing the S3 bucket name
D. An alias A record targeting the private S3 bucket directly

Correct answer: A

Explanation: The custom domain should resolve to the CloudFront distribution through a Route 53 alias A record. The S3 bucket remains the protected origin rather than the public DNS target.

Question 5

A lab distribution is no longer needed. An engineer selects delete immediately, but deletion is unavailable. What is the correct next step?

A. Make the S3 bucket public, then retry deletion
B. Disable the distribution, wait for the disabled state, and then delete it
C. Remove the ACM certificate first and leave the distribution active
D. Delete the Route 53 hosted zone only

Correct answer: B

Explanation: CloudFront distributions must first be disabled. After the disabled state completes, the distribution can be deleted.

WordPress Metadata

Suggested Slug:
configure-protected-s3-origin-cloudfront

Meta Description:
Learn how to protect an Amazon S3 origin with CloudFront Origin Access Control, HTTPS, ACM, Route 53, and a default root object.

Tags:
AWS CloudFront, Amazon S3, Origin Access Control, AWS Certificate Manager, Amazon Route 53, HTTPS, CloudFront distributions, AWS WAF, CloudOps