SCS-C02 Question 125
Single answerYou are working as a security engineer for a company that uses Amazon S3 to store sensitive customer data. The company requires that all objects in S3 be encrypted at rest and wants to enforce this policy to ensure compliance. How can you achieve this requirement effectively?
- A
Enable default encryption on the S3 bucket using an AWS-managed key (SSE-S3) or a customer-managed key (SSE-KMS).
- B
Create an S3 bucket policy that denies uploads of unencrypted objects unless they include the 'x-amz-server-side-encryption' header.
- C
Enable versioning on the S3 bucket to ensure compliance with encryption requirements.
- D
Use AWS CloudTrail to monitor S3 API calls and identify unencrypted objects.
Show answer and explanation
Correct answer: B
Explanation
The best way to enforce encryption compliance for an S3 bucket is by using a bucket policy that explicitly denies uploads of unencrypted objects unless they include the 'x-amz-server-side-encryption' header. This ensures that any attempt to upload unencrypted objects is blocked, maintaining compliance with the company's requirement.
- A. Incorrect.
While enabling default encryption ensures that all objects uploaded to the bucket are encrypted by default, it does not enforce a policy. Objects can still be uploaded without encryption if the default encryption setting is accidentally overridden.
- B. Correct.
Creating a bucket policy to deny uploads of unencrypted objects ensures that only encrypted objects are stored in the bucket, enforcing compliance effectively.
- C. Incorrect.
Versioning is used to retain multiple versions of objects in an S3 bucket. It does not enforce or ensure encryption compliance.
- D. Incorrect.
AWS CloudTrail helps in monitoring API calls and identifying compliance violations but does not actively prevent uploads of unencrypted objects.