Login- Consulting
- Training
- Partners
- About Us
x
NPO
AWS Config, Amazon CloudWatch, Amazon S3, AWS IAM
Enabled smart insights and seamless compliance with real-time monitoring
The customer is a global digital services company that provides digital content and services to users worldwide. They prioritize secure, reliable, and high-performance delivery, requiring strict control over who can access their content, when, and under what conditions, while ensuring minimal impact on their backend system.
Access Control Accuracy
Security Posture Improvement
Latency Improvement
The client needed to enhance CloudFront security by preventing direct origin access bypass and enforcing signature validation at the edge. Legacy trusted AWS accounts with root-managed key pairs posed operational risks and required replacement with trusted key groups for API-driven management. The solution needed granular control to apply signer requirements only to specific cache behaviors, enabling mixed public and private content delivery. Additionally, seamless key rotation capabilities were required without service disruption to ensure operational continuity.
• Implemented Amazon CloudFront trusted key groups for signed URLs/cookies with targeted cache behaviors and application signing integration.
• Generated RSA-2048 key pairs with secure storage in HSM/AWS Secrets Manager and created Public Key and Key Group in Amazon CloudFront.
• Identified private paths and configured cache behaviors with Restrict Viewer Access while keeping public behaviors unrestricted.
• Implemented signing using Amazon CloudFront SDKs with key pair ID and private key for URLs and cookies.
• Validated Amazon CloudFront signature checks at the edge and tested seamless key rotation with monitoring.
Achieved 100% access control validation, 90% governance risk reduction, 25% origin load decrease, sub-30 minute key rotation, 15% latency improvement, and full AWS compliance.
SHARE
Our support doesn't end here. We have monthly newsletters, study guides, practice questions, and more to assist you in upgrading your cloud career. Subscribe to get them all!
