Q273.A media company has a static web application that is generated programmatically The company has a build pipeline that generates HTML content that is uploaded to an Amazon S3 bucket served by Amazon CloudFront. The build pipeline runs inside a Build Account. The S3 bucket and CloudEront distribution are in a Distribution Account. The build pipeline uploads the files to Amazon S3 using an lAM role in the Build Account. The S3 bucket has a bucket policy that only allows CloudEront to read objects using an origin access identity (CAl). During testing all attempts to access the application using the CloudFront URL result in an HTTP 403 Access Denied response. What should a solutions architect suggest to the company to allow access the objects in Amazon S3 through CloudFront?
A.Modify the S3 upload process in the Build Account to add the bucket-owner- full-control AOL to the objects at upload. B.Create a new cross-account lAM role in the Distribution Account with write access to the 83 bucket. Modify the build pipeline to assume this role to upload the files to the Distribution Account. C.Modify the S3 upload process in the Build Account to set the object owner to the Distribution Account. D.Create a new lAM role in the Distribution Account with read access to the 83 bucket. Configure CloudFtont to use this new role as its OAI. Modify the build pipeline to assume this role when uploading files from the Build Account.正确答案A
