[Security and Compliance] A SysOps administrator needs to configure an Amazon S3 bucket to host a web application. The SysOps administrator has…

To host a web application in an S3 bucket while adhering to the policy that prohibits public S3

buckets:

Amazon CloudFront: Set up a CloudFront distribution and designate the S3 bucket as its origin. This

allows the web application to be served via CloudFront, which can handle web traffic at scale and

provide additional features such as HTTPS delivery.

Origin Access Identity (OAI): Create an OAI for the CloudFront distribution and configure the S3

bucket policy to grant the s3:GetObject permission to the OAI. This allows only CloudFront to access

the content in the S3 bucket, keeping the bucket private from direct public access.

Security and Performance: This configuration ensures that the web application is only accessible

through CloudFront, enhancing security and performance. It also complies with the company's policy

against public S3 buckets by controlling access strictly through CloudFront.

This method leverages CloudFront's capabilities to securely serve web applications from S3,

maintaining privacy and compliance with organizational policies.