DOP-C02 Question 255
Single answerYour organization uses AWS Config to ensure compliance with security policies. A new requirement mandates that all S3 buckets must have default encryption enabled. You are tasked with implementing a solution to monitor this compliance automatically. How can you achieve this with minimal operational overhead?
- A
Use the AWS Config managed rule 's3-bucket-server-side-encryption-enabled' to automatically check for default encryption on all S3 buckets.
- B
Write a custom Lambda function to periodically scan all S3 buckets for encryption settings and send the results to AWS Config.
- C
Manually review the encryption settings of each S3 bucket and log compliance in AWS Config.
- D
Enable CloudTrail logs and analyze them manually to identify S3 buckets without encryption.
Show answer and explanation
Correct answer: A
Explanation
AWS Config provides managed rules to simplify compliance monitoring for common use cases. The 's3-bucket-server-side-encryption-enabled' rule automatically checks all S3 buckets for default encryption, eliminating the need for custom solutions or manual processes. Using this managed rule aligns with the requirement of minimal operational overhead while ensuring compliance.
- A. Correct.
This is the correct option. AWS Config provides a managed rule called 's3-bucket-server-side-encryption-enabled' that automatically evaluates whether S3 buckets have default encryption enabled, minimizing operational overhead.
- B. Incorrect.
This option is incorrect because writing a custom Lambda function introduces additional operational overhead and is unnecessary when a managed rule already exists for this use case.
- C. Incorrect.
This option is incorrect because manually reviewing bucket settings is time-consuming, prone to errors, and does not provide automated compliance monitoring.
- D. Incorrect.
This option is incorrect because analyzing CloudTrail logs manually does not provide proactive compliance enforcement or automation, which is required for minimal operational overhead.