A city open-data static site is stored in Amazon S3 and must be delivered publicly through Amazon CloudFront without leaving the bucket widely open to direct public access. Which design should the architect use?
Select an answer to reveal the explanation.
Short Explanation
CloudFront is the public reading room; the S3 shelf stays locked except to that room attendant. Origin Access Control (or OAI) lets only CloudFront fetch objects. World-writable buckets, anonymous FTP, or HTML inside IAM policies miss secure content delivery.
Full Explanation
Amazon CloudFront with Origin Access Control (OAC) or the older Origin Access Identity (OAI) pattern restricts an S3 origin so objects are not broadly public while remaining reachable through the distribution. Bucket policies grant the CloudFront service principal access to the objects. Public write, FTP-style anonymous access, and embedding site content in IAM documents are incorrect secure-delivery designs for open-data static websites.