SCS-C02 Question 127
Single answerA company is using Amazon S3 to store sensitive customer data. The security team wants to ensure that all objects stored in the S3 bucket are encrypted and that only the company's own AWS Key Management Service (KMS) keys are used for encryption. How can the security team enforce this requirement?
- A
Enable default encryption on the S3 bucket using an AWS KMS key.
- B
Apply a bucket policy that denies any S3 PUT request that does not include server-side encryption with the specified AWS KMS key.
- C
Use an S3 lifecycle policy to enforce encryption on objects within the bucket.
- D
Enable S3 Object Lock in compliance mode to enforce encryption with the AWS KMS key.
Show answer and explanation
Correct answer: B
Explanation
The best way to enforce that all objects are encrypted with a specific AWS KMS key is to use an S3 bucket policy. A bucket policy can explicitly deny any PUT request that does not include server-side encryption with the designated KMS key, ensuring compliance with company requirements. While enabling default encryption can help, it does not prevent non-compliant requests, and other options like lifecycle policies or Object Lock are unrelated to encryption enforcement.
- A. Incorrect.
Enabling default encryption on the S3 bucket using an AWS KMS key helps to encrypt objects by default, but this alone does not prevent non-compliant requests that bypass encryption settings.
- B. Correct.
Applying a bucket policy that denies any S3 PUT request without server-side encryption and the specified AWS KMS key directly enforces the requirement at the bucket level.
- C. Incorrect.
S3 lifecycle policies are used for managing object storage lifecycle (e.g., transitioning or expiring objects) and cannot enforce encryption settings.
- D. Incorrect.
S3 Object Lock is used for write-once-read-many (WORM) compliance but does not enforce encryption settings.