Q84 — AWS SAA-C03 Ch.13

Question 84 of 100 | ← Chapter 13

Q984. A company is planning to use an Amazon CloudFront distribution to deploy an application. The CloudFront distribution uses an Amazon S3 bucket as the origin. Only authorized users should be able to access the application.Files that the company caches at edge locations must be accessible only after a user is authenticated.A solutions architect needs to design a secure and low-latency solution to meet these requirements.Which solution will meet these requirements?

Correct Answer: D. Use the viewer request Lambda@Edge function in CloudFront to handle authentication and authorization.

Explanation

B OR D!!D. Use the viewer request Lambda@Edge function in CloudFront to handle authentication and authorization.Explanation:A. Create an Application Load Balancer (ALB) as a second origin in CloudFront. Direct users to authenticate at the ALB first.- This solution would add an additional layer of complexity and latency, as the users would first need to authenticate at the ALB before being able to access the content from the S3 bucket.B. Use the origin response Lambda@Edge function in CloudFront to handle authentication and authorization- This would not be the most efficient solution, as the origin response function is executed after the content is retrieved from the origin, but before it is cached and delivered to the user.C. Create a Network Load Balancer (NLB) as a second origin in CloudFront. Direct users to authenticate at the NLB first.- Similar to the Application Load Balancer solution, this would add an additional layer of complexity and latency.D. Use the viewer request Lambda@Edge function in CloudFront to handle authentication and authorization.- This is the correct solution to meet the requirements.- The viewer request Lambda@Edge function is executed when a user first requests the content from CloudFront, before the content is retrieved from the origin (S3 bucket).- This allows you to perform the authentication and authorization checks on the user request, before the content is cached and delivered to the user.- By using the viewer request function, you can ensure that only authorized users can access the cached content at the edge locations, without adding any additional latency.Therefore, the best solution is to use the viewer request Lambda@Edge function in CloudFront to handle authentication and authorization, ensuring that only authorized users can access the cached content at the edge locations.