Wrong wording possibly in explanation of this question?

[Gowtham Padala]

For question:

53. Question1 point(s)
Category: SEC – Infrastructure Security
A company has a static website hosted in an S3 bucket. The Security Engineer has been instructed to configure the system to allow the users to access the site via an Amazon CloudFront distribution. The users must also be prevented from directly accessing the website using an Amazon S3 URL to avoid any unauthorized access.

Which combination of actions will satisfy these requirements? (Select TWO.)

Edit the S3 bucket permissions to allow the OAC access to the S3 bucket objects.
Create a new VPC Gateway Endpoint. Host the CloudFront web distribution into the specified VPC and modify the bucket policy to only allow incoming traffic through the VPC Endpoint.
Configure the S3 website endpoint to be the origin of the CloudFront distribution, and associate it with an Origin Access Control (OAC).

Modify the S3 bucket policy and add this line: “Principal”: “cloudfront.amazonaws.com“.
Modify the associated security group of the S3 bucket to only allow inbound traffic from CloudFront.

From ChatGPT:

The intended concept is CloudFront OAC + a private S3 bucket, but there is an important issue with the answer wording you pasted: OAC does not work with an S3 website endpoint. AWS says that if the bucket is configured as an S3 website endpoint, CloudFront must treat it as a custom origin, and OAC/OAI cannot be used. AWS Documentation
So the secure pattern is:
Users
↓
CloudFront
↓
OAC signs the request
↓
Private S3 bucket

Direct access like:
https://mybucket.s3.amazonaws.com/index.html

gets denied, while:
https://d123.cloudfront.net/index.html

works. OAC is specifically meant to let CloudFront access the S3 origin while preventing direct bucket access. AWS Documentation
Example
Suppose the bucket is:
s3://my-company-site

You keep Block Public Access enabled.
Then the bucket policy allows only the CloudFront service principal, constrained to your specific distribution:
CloudFront distribution ABC123
↓
allowed s3:GetObject

Everyone else:
Random Internet user → S3 directly ❌
CloudFront → S3 ✅

Why “Edit the S3 bucket permissions to allow the OAC” is correct
OAC by itself doesn’t magically grant access. The S3 bucket policy must allow CloudFront to read the objects.
Conceptually:
Principal:
cloudfront.amazonaws.com

Action:
s3:GetObject

Condition:
SourceArn = your CloudFront distribution

That is the actual authorization layer.
Why the “S3 website endpoint + OAC” option is problematic
This is the big nuance.
The option says:
Configure the S3 website endpoint as the origin and associate OAC.

Current AWS documentation says that combination is not supported. An S3 website endpoint must be configured as a custom origin, and OAC cannot be used with it. AWS Documentation
For OAC, you should use the regular S3 bucket origin, conceptually:
bucket-name.s3.<region>.amazonaws.com

not:
bucket-name.s3-website-<region>.amazonaws.com

So Tutorials Dojo’s answer wording is technically flawed here.
Why VPC endpoint is wrong
CloudFront doesn’t live inside your VPC.
So this does not make sense:
CloudFront
↓
put inside VPC
↓
S3 Gateway Endpoint

A VPC endpoint is for resources in your VPC privately reaching S3.
Why S3 security group is wrong
S3 buckets do not have security groups.
Security groups attach to resources such as:
– EC2
– ENIs
– load balancers
– RDS
not S3 buckets.
For S3, use:
bucket policies, IAM, Block Public Access, access points, etc.

Why just “Principal”: “cloudfront.amazonaws.com” is incomplete
The idea is directionally right, but you should normally restrict it to your specific CloudFront distribution using AWS:SourceArn.
Otherwise, you’re not expressing the intended least-privilege OAC setup.
Exam shortcut
Think:
CloudFront only access to private S3 → OAC + S3 bucket policy

And crucially:
OAC → regular S3 bucket origin
S3 website endpoint → custom origin, no OAC

So for this particular practice question, I would remember the intended pair as OAC + bucket-policy permission, while also knowing that the phrase “website endpoint + OAC” is technically incorrect in current AWS.

[JR-TutorialsDojo]

Hello Gowtham Padala,

Thank you for bringing this to our attention.

You are correct that using an S3 website endpoint with an Origin Access Control (OAC) is not supported. We’ll make the necessary updates, which should be reflected on the portal soon.

Regards,
JR @ Tutorials Dojo