Add Security Headers to CloudFront Distribution with S3 Origin

Answer - B.

One of the AWS Blogs mentions the following.

Lambda@Edge provides the ability to execute a Lambda function at an Amazon CloudFront Edge Location.

This capability enables intelligent processing of HTTP requests at locations that are close (for the purposes of latency) to your customers.

To get started, you simply upload your code (Lambda function written in Node.js) and pick one of the CloudFront behaviors associated with your distribution.

All other options are incorrect since none of these will help meet the requirement.

For more information on adding security headers using Lambda@Edge, one can visit the below URL.

https://aws.amazon.com/blogs/networking-and-content-delivery/adding-http-security-headers-using-lambdaedge-and-amazon-cloudfront/

To add security headers to HTTP responses in a CloudFront distribution with an S3 bucket origin, there are several possible options:

A. Change the Behavior of the origin: CloudFront behaviors determine how CloudFront handles user requests and the origin's responses. By changing the behavior of the origin, we can configure CloudFront to add security headers to the HTTP responses. To achieve this, you can follow these steps:

1. Sign in to the AWS Management Console and open the CloudFront console.
2. Select the CloudFront distribution with the S3 bucket origin.
3. Choose the Behaviors tab.
4. Select the behavior that you want to update.
5. In the Origin settings section, choose Edit.
6. In the Origin Custom Headers section, add the necessary security headers and their values.

B. Create a Lambda function that will run on the edge: AWS Lambda lets you run code in response to events in AWS services such as CloudFront. You can use Lambda@Edge to add security headers to HTTP responses. To do so, follow these steps:

1. Create a Lambda function that adds the required security headers.
2. In the CloudFront console, select the CloudFront distribution that you want to update.
3. Choose the Behaviors tab.
4. Select the behavior that you want to update.
5. In the Lambda Function Associations section, choose the option to add a new function association.
6. Select the Lambda function that you created in step 1.
7. Choose the CloudFront event for which you want to invoke the function (e.g., viewer request, origin response).
8. Save the changes.

C. Make sure that the Viewer protocol is set to HTTPS: By default, CloudFront uses HTTPS to communicate with viewers. If the viewer protocol is set to HTTP, CloudFront will not add security headers to the HTTP response. To ensure that the viewer protocol is set to HTTPS, follow these steps:

1. Sign in to the AWS Management Console and open the CloudFront console.
2. Select the CloudFront distribution with the S3 bucket origin.
3. Choose the Behaviors tab.
4. Select the behavior that you want to update.
5. In the Viewer Protocol Policy section, choose the option to redirect HTTP to HTTPS.

D. Create an OAI for the Cloudfront distribution: An Origin Access Identity (OAI) is a virtual user that Amazon CloudFront uses to fetch private content from an S3 bucket. By creating an OAI and using it to secure access to the S3 bucket, you can add security headers to HTTP responses. To achieve this, follow these steps:

1. Create an OAI.
2. Grant read permissions to the OAI on the S3 bucket that serves as the origin.
3. Update the CloudFront distribution to use the OAI.
4. In the behavior that you want to update, select the option to forward all headers to the origin.
5. In the S3 bucket, configure the necessary security headers.

Overall, any of these four options can be used to add security headers to HTTP responses in a CloudFront distribution with an S3 bucket origin. The choice depends on the specific requirements and constraints of your use case.