DOP-C02 Question 258
Select 2Your organization wants to enforce compliance by ensuring that all S3 buckets have server-side encryption enabled. You have been tasked with setting up a solution using AWS Config. Which combination of actions should you take to meet this requirement?
- A
Create an AWS Config managed rule called 's3-bucket-server-side-encryption-enabled' and associate it with your AWS Config configuration recorder.
- B
Enable AWS Config in the region where your S3 buckets are deployed and ensure the configuration recorder and delivery channel are set up.
- C
Write a custom AWS Lambda function to check for server-side encryption on S3 buckets and create a custom AWS Config rule using that function.
- D
Enable S3 bucket versioning to work alongside the AWS Config rule to ensure compliance checks are performed.
- E
Use AWS Config to delete non-compliant S3 buckets automatically upon detection.
Show answer and explanation
Correct answers: A, B
Explanation
To enforce compliance for S3 bucket server-side encryption, you can leverage AWS Config managed rules. The 's3-bucket-server-side-encryption-enabled' rule is specifically designed for this purpose. Additionally, AWS Config must be properly enabled, with a configuration recorder and delivery channel set up in the relevant region, for the rule to function. There is no need to write custom rules or use unrelated features like bucket versioning. AWS Config itself does not perform actions like deleting non-compliant resources; it only provides visibility into compliance status.
- A. Correct.
Correct: AWS Config provides a managed rule called 's3-bucket-server-side-encryption-enabled' that checks whether server-side encryption is enabled on S3 buckets. Associating this rule with the configuration recorder ensures compliance is monitored.
- B. Correct.
Correct: AWS Config must be enabled in the region where your resources are deployed. Setting up the configuration recorder and delivery channel ensures that resource configuration changes are captured and compliance reports can be delivered.
- C. Incorrect.
Incorrect: While you can use a custom AWS Lambda function to create a custom AWS Config rule, this is unnecessary for the given scenario since AWS already provides a managed rule for this use case.
- D. Incorrect.
Incorrect: S3 bucket versioning is unrelated to AWS Config rules and does not play a role in ensuring compliance with server-side encryption requirements.
- E. Incorrect.
Incorrect: AWS Config does not have the capability to automatically delete non-compliant resources. It is a monitoring and reporting tool, not an enforcement mechanism.