Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 427 discussion

In this blog post, you’ll see how to use CloudFront custom headers, AWS WAF, and AWS Secrets Manager to restrict viewer requests from accessing your CloudFront origin resources directly. https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/

While secret manager can auto rotate the secrets why to use Lamda to rotate? The choice B is neater than A?

Option A is right Store a random string in Secrets Manager: This provides a secure way to store sensitive data, such as a token or secret key. Create an AWS Lambda function for automatic secret rotation: This ensures that the secret is regularly rotated and updated to prevent unauthorized access. Configure CloudFront to inject the random string as a custom HTTP header for the origin request: This adds an additional layer of protection by requiring the ALB to verify the custom header before allowing access. Create an AWS WAF web ACL rule with a string match rule for the custom header: This checks that the custom header matches the expected value, preventing unauthorized access if it doesn't. Associate the web ACL with the ALB: This ensures that the security rules are enforced at the edge of the network, protecting against malicious traffic. The other options don't provide sufficient protection:

D is the correct Answer

Option A

Answer is A

A - is a proper answer https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/

Correct Answer is A