ACM SSL/TLS Certificates with CloudFront and S3 – SAP-C02 Study Guide

Purpose of This Lesson

This lesson demonstrates how to publish a static website stored in Amazon S3 through Amazon CloudFront using a custom domain name and an SSL/TLS certificate issued by AWS Certificate Manager (ACM).

The resulting architecture provides:

• Private S3 object storage behind CloudFront.
• CloudFront distribution-level HTTPS encryption.
• A custom DNS name managed in Amazon Route 53.
• DNS validation for the ACM public certificate.
• HTTP-to-HTTPS redirection.
• Access control through CloudFront Origin Access Control (OAC).

Key Concepts

AWS Certificate Manager public certificates

ACM can issue and manage public SSL/TLS certificates for domain names that you control. Before ACM issues the certificate, you must prove domain ownership through one of the supported validation methods:

• DNS validation: ACM provides a CNAME record that must be added to the domain’s DNS zone. This is generally the preferred method because it is automated and can support managed renewal.
• Email validation: ACM sends validation messages to domain-related administrative addresses. This can be less convenient operationally and may require manual intervention.

For a certificate used by Amazon CloudFront, request or import the certificate in the US East (N. Virginia) Region (us-east-1), regardless of where the S3 bucket, Route 53 hosted zone, or users are located. This is a frequent exam and implementation gotcha.

CloudFront custom domain configuration

A CloudFront distribution uses an alternate domain name, also called a CNAME, to serve content through a custom hostname such as www.example.com. The distribution must have an ACM certificate whose domain names cover that hostname.

For example, a certificate for example.com does not automatically cover www.example.com; the certificate must explicitly include www.example.com or use an appropriate wildcard such as *.example.com.

CloudFront can be configured to:

• Allow HTTP and HTTPS.
• Redirect HTTP requests to HTTPS.
• Require HTTPS for viewer connections.

Redirecting HTTP to HTTPS is a common choice for public static websites because it preserves compatibility while ensuring the final connection is encrypted.

S3 Origin Access Control

The S3 bucket should not be publicly readable when CloudFront is the intended delivery layer. CloudFront Origin Access Control allows CloudFront to authenticate to S3 using a service principal and signed requests.

The bucket policy typically grants s3:GetObject to the CloudFront service principal only for the specific distribution. A conceptual policy condition looks like this:

{
  "Effect": "Allow",
  "Principal": {
    "Service": "cloudfront.amazonaws.com"
  },
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::example-bucket/*",
  "Condition": {
    "StringEquals": {
      "AWS:SourceArn": "arn:aws:cloudfront::<account-id>:distribution/<distribution-id>"
    }
  }
}

The exact policy generated by the CloudFront console should be used for the selected distribution. The bucket should remain blocked from direct public access.

OAC is the modern approach for securing an S3 origin. Do not confuse it with the older Origin Access Identity (OAI), which may still appear in legacy architectures and exam scenarios.

Route 53 records for validation and traffic routing

Two different DNS records can be involved:

1. ACM validation CNAME: Proves domain ownership. This record should remain in DNS if automatic certificate renewal is required.
2. Application alias record: Routes the custom domain to the CloudFront distribution. For an apex domain such as example.com, use a Route 53 alias record because a standard CNAME cannot be placed at the DNS zone apex.

The validation CNAME and the application record serve different purposes. Removing the validation record immediately after issuance can prevent or complicate future renewal.

A Route 53 alias record can point to a CloudFront distribution without the DNS limitations and per-query behavior of a conventional CNAME. Common records include:

• example.com → CloudFront alias target.
• www.example.com → CloudFront alias target.

Default root object

Set the CloudFront Default root object to a file such as index.html. This allows a request to the distribution or custom domain root to retrieve that object instead of requiring the full object path.

The referenced file and all supporting assets, such as CSS and images, must exist in the S3 origin using the paths expected by the HTML document.

Exam-Relevant Takeaways

• ACM public certificates can be validated through DNS or email; DNS validation is normally easier to automate.
• CloudFront certificates must be available in us-east-1.
• The certificate’s SANs or wildcard names must match the CloudFront alternate domain name.
• Configure the CloudFront viewer protocol policy to redirect HTTP to HTTPS or require HTTPS.
• Use CloudFront OAC and a restrictive S3 bucket policy rather than making the bucket public.
• The bucket policy should grant CloudFront s3:GetObject access to the required object path and restrict the request to the intended distribution with AWS:SourceArn.
• Use a Route 53 alias record to point a custom domain to CloudFront, including for an apex domain.
• The ACM validation CNAME should generally remain present for renewal.
• CloudFront deployment changes are asynchronous and may take time to complete.
• A CloudFront distribution must be disabled before it can be deleted; associated resources may need to be removed afterward.

Architecture Decision Guide

Requirement	Recommended AWS configuration	Important consideration
Encrypt traffic from users to the CDN	ACM certificate attached to CloudFront	Certificate must be in us-east-1
Validate control of a domain	ACM DNS validation	Keep the validation CNAME for renewal
Serve a custom hostname	CloudFront alternate domain name plus matching certificate	Every hostname must be covered by the certificate
Prevent direct public S3 access	CloudFront OAC plus bucket policy	Keep S3 Block Public Access enabled where compatible
Redirect insecure requests	CloudFront viewer protocol policy: Redirect HTTP to HTTPS	Redirects improve usability while enforcing secure access
Point DNS to CloudFront	Route 53 alias record	Alias records work at the zone apex
Serve / as a website document	CloudFront default root object	Usually set to index.html
Remove a test deployment	Disable, wait for completion, then delete CloudFront	Distribution deletion is not immediate

Common Exam Traps

• Requesting the CloudFront certificate in the wrong Region: CloudFront uses ACM certificates from us-east-1.
• Using an S3 website endpoint with OAC: OAC applies to an S3 REST origin, not the S3 static website hosting endpoint. Website endpoints also typically require public access and HTTP behavior, which conflicts with a private OAC design.
• Forgetting the S3 bucket policy: Creating OAC alone does not authorize CloudFront to read objects. The S3 bucket policy must grant the required access.
• Using a CNAME for an apex domain: DNS standards do not allow a conventional CNAME at example.com; use a Route 53 alias record.
• Certificate name mismatch: A certificate for example.com does not necessarily cover app.example.com.
• Deleting the ACM validation record: The certificate may initially be issued, but removing the record can interfere with managed renewal.
• Assuming CloudFront changes are immediate: Distribution creation, configuration changes, and deletion are asynchronous.
• Making the S3 bucket public “to make CloudFront work”: This bypasses the intended origin protection and is usually the wrong security design.

Real-World Engineer Notes

• Use separate certificates or carefully planned SANs and wildcard names for production hostnames. Avoid overly broad wildcard coverage when it creates unnecessary trust.
• Keep the ACM certificate and Route 53 validation records under controlled ownership. In multi-account environments, certificate issuance and CloudFront deployment may occur in different accounts, requiring explicit operational coordination.
• Consider enabling CloudFront access logging, AWS WAF, and appropriate cache policies for production workloads. These were not required for the basic static-site demonstration.
• Origin protection does not protect the S3 bucket from an overly permissive policy. Review both the bucket policy and account-level S3 Block Public Access settings.
• For a static site, ensure object paths, case sensitivity, content types, and cache invalidation behavior are correct. A valid certificate does not resolve application-level 403 or 404 errors.
• Clean up lab resources deliberately. CloudFront distributions can take substantial time to disable, and S3 buckets must be emptied before deletion.

Quick Reference Summary

User
  |
  | HTTPS using custom domain
  v
Route 53 alias record
  |
  v
CloudFront distribution
  |-- ACM certificate in us-east-1
  |-- Alternate domain name
  |-- Redirect HTTP to HTTPS
  |-- Origin Access Control
  v
Private S3 bucket
  |-- Bucket policy allows CloudFront GetObject
  |-- index.html, CSS, and image assets

Implementation sequence:

1. Upload website objects to S3.
2. Request an ACM public certificate in us-east-1 for the intended hostname.
3. Add the ACM DNS validation CNAME through Route 53.
4. Wait until the certificate status becomes Issued.
5. Create a CloudFront distribution with the S3 REST origin.
6. Configure OAC and update the S3 bucket policy.
7. Set the alternate domain name, ACM certificate, HTTPS policy, and default root object.
8. Create a Route 53 alias record pointing to CloudFront.
9. Test both HTTP redirection and HTTPS access.

Flashcards

1. Q: In which Region must an ACM certificate for CloudFront be requested?

A: US East (N. Virginia), us-east-1.

1. Q: What is the preferred ACM validation method for automation?

A: DNS validation using an ACM-provided CNAME record.

1. Q: What CloudFront setting maps a custom hostname to a distribution?

A: An alternate domain name, also called a CNAME.

1. Q: What must match between an alternate domain name and an ACM certificate?

A: The certificate must include the hostname in its subject alternative names or an applicable wildcard.

1. Q: What is the modern method for granting CloudFront authenticated access to an S3 origin?

A: Origin Access Control.

1. Q: What S3 permission does a basic CloudFront static-content policy usually grant?

A: s3:GetObject.

1. Q: Which AWS service principal is used in an OAC-based S3 bucket policy?

A: cloudfront.amazonaws.com.

1. Q: What Route 53 record should point an apex domain to CloudFront?

A: An alias record.

1. Q: What CloudFront setting serves index.html for a request to /?

A: Default root object.

1. Q: What should happen to HTTP requests when HTTPS is mandatory?

A: CloudFront should redirect them to HTTPS or reject them, depending on the selected viewer protocol policy.

1. Q: Should the ACM DNS validation CNAME be removed after issuance?

A: Generally no; retain it to support managed renewal.

1. Q: Can an enabled CloudFront distribution be deleted immediately?

A: No. It must first be disabled, and the disabling process must complete.

Practice Questions

Question 1

A company hosts private static assets in Amazon S3 and wants users to access them through www.example.com over HTTPS using CloudFront. The S3 bucket must not be publicly accessible. Which design meets the requirements?

A. Enable S3 website hosting, allow public s3:GetObject, and configure CloudFront with the website endpoint.
B. Configure CloudFront with the S3 REST endpoint, create an OAC, and update the bucket policy for the CloudFront distribution.
C. Configure CloudFront with the S3 REST endpoint and allow anonymous access only to index.html.
D. Use an S3 access point without a CloudFront distribution.

Correct answer: B

Explanation: OAC provides authenticated CloudFront access to a private S3 REST origin. A restrictive bucket policy grants the CloudFront service principal access to objects for the intended distribution. An S3 website endpoint is not the appropriate origin for OAC.

Question 2

An architect requests an ACM certificate in eu-west-1 and attempts to attach it to a CloudFront distribution. The certificate does not appear in the CloudFront certificate list. What is the most likely cause?

A. The certificate uses DNS validation.
B. The certificate is still pending renewal.
C. The certificate was not requested in us-east-1.
D. CloudFront supports only wildcard certificates.

Correct answer: C

Explanation: CloudFront requires ACM certificates to be in US East (N. Virginia), us-east-1. DNS validation and wildcard certificates are both supported, subject to normal hostname matching.

Question 3

A company owns example.com in a Route 53 hosted zone and wants both the zone apex and CloudFront to use HTTPS. Which configuration is appropriate?

A. Create a CNAME at example.com pointing to CloudFront and use any ACM certificate.
B. Create a Route 53 alias record at example.com, configure it to target CloudFront, and attach a certificate covering example.com.
C. Create an MX record at example.com pointing to CloudFront.
D. Use the ACM validation CNAME as the application DNS record.

Correct answer: B

Explanation: Route 53 alias records can target CloudFront and can be used at the zone apex. The certificate must cover the requested hostname. The ACM validation CNAME is only for proving domain ownership and is not the traffic-routing record.

Question 4

A CloudFront distribution returns AccessDenied for objects in an S3 bucket after OAC was configured. The bucket is private. Which action should be checked first?

A. Add an Internet Gateway to the S3 bucket.
B. Change the CloudFront viewer protocol policy to HTTP only.
C. Verify that the S3 bucket policy grants s3:GetObject to cloudfront.amazonaws.com with the correct distribution source ARN.
D. Replace the ACM certificate with an imported certificate.

Correct answer: C

Explanation: OAC establishes the CloudFront origin access mechanism, but S3 still requires an authorization policy. A missing or incorrect bucket policy commonly causes AccessDenied responses.

Question 5

A static website is available at http://www.example.com, but the organization requires all users to end up on HTTPS. Which CloudFront setting should be used?

A. Viewer protocol policy set to Redirect HTTP to HTTPS.
B. Origin protocol policy set to HTTP only.
C. Disable the ACM certificate.
D. Configure the S3 bucket for anonymous access.

Correct answer: A

Explanation: The CloudFront viewer protocol policy controls how client requests are handled. Redirecting HTTP to HTTPS provides a secure final connection while allowing users who initially enter an HTTP URL to be redirected automatically.