DOP-C02 Question 371
Select 2Your organization requires that all S3 buckets storing sensitive data must be encrypted, and any unencrypted bucket should automatically trigger remediation to enable encryption. You need to implement a solution to automate this security control using AWS services. Which combination of actions should you take to meet this requirement?
- A
Use AWS Config with a managed rule to check if S3 buckets have default encryption enabled.
- B
Set up an Amazon EventBridge rule to detect non-compliant S3 buckets and trigger an AWS Lambda function for remediation.
- C
Enable S3 Block Public Access on all buckets to ensure sensitive data is protected.
- D
Use AWS Systems Manager State Manager to enforce encryption on S3 buckets.
- E
Configure AWS Config to trigger an AWS Systems Manager Run Command that applies encryption settings when a bucket is non-compliant.
Show answer and explanation
Correct answers: A, B
Explanation
To automate the enforcement of encryption on S3 buckets, AWS Config can be used to monitor compliance with encryption requirements. A managed Config rule such as 's3-bucket-server-side-encryption-enabled' identifies non-compliant buckets. When a bucket is found to be non-compliant, Amazon EventBridge can trigger an AWS Lambda function to apply the necessary encryption settings. This combination of AWS services ensures both monitoring and automated remediation of security controls for data protection.
- A. Correct.
Correct: AWS Config provides managed rules such as 's3-bucket-server-side-encryption-enabled' to check for default encryption on S3 buckets. This is a key step in automating the security control.
- B. Correct.
Correct: Amazon EventBridge can detect changes in bucket compliance status and trigger an AWS Lambda function to remediate the issue, such as enabling default encryption.
- C. Incorrect.
Incorrect: While enabling S3 Block Public Access is a best practice for securing S3 buckets, it does not address whether the bucket is encrypted.
- D. Incorrect.
Incorrect: AWS Systems Manager State Manager is not designed for enforcing encryption on S3 buckets. It is more commonly used for managing configurations on EC2 instances and on-premises systems.
- E. Incorrect.
Incorrect: While AWS Config can trigger AWS Systems Manager actions, this is not a common or recommended approach for remediating S3 bucket encryption settings. Using EventBridge and Lambda is a more appropriate solution in this case.