SAP-C02 Question 218
Single answerYour company has a multi-account AWS environment managed using AWS Organizations. A new compliance requirement mandates that all S3 buckets across all accounts must have default encryption enabled. You need a scalable solution to enforce this policy and ensure continuous compliance without manual intervention. Which solution should you implement?
- A
Use AWS Config with a managed rule to check for default encryption and notify administrators of non-compliant S3 buckets.
- B
Set up an SCP (Service Control Policy) in AWS Organizations to deny the creation of S3 buckets without default encryption enabled.
- C
Create a Lambda function that periodically scans all accounts for non-compliant S3 buckets and enables default encryption automatically.
- D
Use AWS Control Tower to enforce default encryption on all S3 buckets across all accounts.
Show answer and explanation
Correct answer: B
Explanation
An SCP in AWS Organizations is the most scalable and proactive way to enforce default encryption on S3 buckets across all accounts. It prevents the creation of non-compliant resources at the account level, ensuring continuous compliance while reducing operational overhead. Other solutions may identify or fix non-compliance but do not prevent it at the source.
- A. Incorrect.
This option only notifies administrators about non-compliant S3 buckets but doesn’t enforce encryption automatically. While AWS Config can ensure compliance through notifications, it doesn’t actively prevent the creation of non-compliant buckets.
- B. Correct.
Using an SCP is the correct approach as it centrally enforces a policy that prevents the creation of S3 buckets without default encryption. This ensures compliance across all accounts without requiring manual intervention or periodic scans.
- C. Incorrect.
While a Lambda function can address compliance by enabling encryption, it is not a scalable or proactive solution. It introduces operational overhead and does not prevent non-compliant buckets from being created in the first place.
- D. Incorrect.
AWS Control Tower provides guardrails for multi-account environments, but it does not natively enforce S3 encryption policies. It is not the appropriate solution for this specific requirement.