DOP-C02 Question 257
Single answerYour company has mandated that all S3 buckets must have server-side encryption enabled. You are tasked with ensuring this requirement is continuously monitored and enforced using AWS Config. Which approach would best meet this requirement?
- A
Use the managed AWS Config rule 's3-bucket-server-side-encryption-enabled' to monitor the S3 buckets and configure an automatic remediation action.
- B
Enable AWS Config in your AWS account and create a custom Lambda function to periodically check for S3 bucket encryption and remediate non-compliant buckets.
- C
Use the managed AWS Config rule 's3-bucket-public-read-prohibited' to ensure S3 buckets are encrypted.
- D
Manually review S3 bucket configurations using the AWS Management Console and enable server-side encryption as needed.
Show answer and explanation
Correct answer: A
Explanation
AWS Config provides managed rules to simplify compliance monitoring for common use cases. The 's3-bucket-server-side-encryption-enabled' rule specifically checks whether server-side encryption is enabled for all S3 buckets. Leveraging this managed rule, combined with automatic remediation actions, is the most efficient and scalable way to enforce compliance as per the company's requirement.
- A. Correct.
This is the correct answer. The AWS Config managed rule 's3-bucket-server-side-encryption-enabled' is designed specifically to check if server-side encryption is enabled for S3 buckets. Additionally, AWS Config supports automatic remediation actions to enforce compliance.
- B. Incorrect.
While creating a custom Lambda function can achieve the goal, it is not the most efficient solution when a managed AWS Config rule is already available for this specific use case.
- C. Incorrect.
This rule ensures that S3 buckets are not publicly readable but does not address server-side encryption requirements, making it irrelevant to the scenario described.
- D. Incorrect.
Manually reviewing S3 bucket configurations is error-prone and not scalable for continuous monitoring, making it an unsuitable approach for ensuring compliance in an automated way.