A company uses an Amazon CloudFront distribution to serve thousands of media files to users. The CloudFront distribution uses a private Amazon S3…

Amazon CloudFront has a built-in feature called geographic restrictions (also known as geo-blocking) that is designed specifically for this use case. This feature allows you to either create an "allowlist" of countries where users can access your content or a "blocklist" of countries where users are denied access. Configuring this is a simple change within the CloudFront distribution's settings, making it the most direct and operationally efficient method to prevent access from specific countries without requiring any application-level changes.

A. Signed URLs are used to provide time-limited, private access to individual files for specific users, not to block entire geographic regions.

C. Signed cookies function similarly to signed URLs but are used to provide access to multiple restricted files, not for implementing broad geographic blocking.

D. Origin access control (OAC) is used to secure the connection between CloudFront and the S3 origin, ensuring that users cannot bypass CloudFront to access the S3 bucket directly. It does not filter end-user requests based on their geographic location.

1. AWS CloudFront Developer Guide

"Restricting the geographic distribution of your content": This document explicitly states

"You can use the CloudFront geographic restrictions feature to prevent users in specific geographic locations from accessing content that you're distributing through a CloudFront distribution." This directly supports option B as the intended solution.

2. AWS CloudFront Developer Guide

"Choosing between signed URLs and signed cookies": This guide explains that signed URLs and cookies are for controlling "who can access your content

" typically on a per-user basis

not based on broad geographic location. This clarifies why options A and C are incorrect for this scenario.

3. AWS CloudFront Developer Guide

"Restricting access to an Amazon S3 origin": This page details the function of Origin Access Control (OAC)

stating its purpose is to "allow you to secure your S3 content by only allowing access from CloudFront

not directly from S3." This confirms that OAC's role is origin security

not end-user geo-filtering

making option D incorrect.