SCS-C02 Question 148
Select 2Your organization has implemented an Amazon S3 bucket to store sensitive customer data. The security team has identified the need to meet compliance requirements by ensuring that all uploaded data is encrypted using server-side encryption with customer-provided keys (SSE-C). The team has also requested to ensure that only secure HTTPS connections are used for uploads. Which of the following actions should you take to enforce these requirements?
- A
Create an S3 bucket policy that denies any PutObject requests where the x-amz-server-side-encryption-customer-algorithm header is missing.
- B
Enable default bucket encryption using SSE-S3 (server-side encryption with S3-managed keys).
- C
Create an S3 bucket policy that denies any requests that do not use the aws:SecureTransport condition key.
- D
Set up an S3 bucket ACL to allow access only to authorized IAM roles.
- E
Use AWS WAF to inspect and block any non-HTTPS requests to the S3 bucket.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the compliance requirements, an S3 bucket policy must be used to enforce server-side encryption with customer-provided keys (SSE-C) and require secure HTTPS connections. The x-amz-server-side-encryption-customer-algorithm header ensures that the encryption requirement is met, while the aws:SecureTransport condition key ensures that only HTTPS connections are allowed. Other options, such as enabling default encryption with SSE-S3 or using AWS WAF, do not meet the specified requirements.
- A. Correct.
Correct. This ensures that all uploads to the bucket must include the proper SSE-C headers for customer-provided keys, enforcing the encryption requirement.
- B. Incorrect.
Incorrect. Enabling default bucket encryption with SSE-S3 does not meet the requirement of using customer-provided keys (SSE-C).
- C. Correct.
Correct. The aws:SecureTransport condition key ensures that only HTTPS connections are allowed, fulfilling the requirement for secure uploads.
- D. Incorrect.
Incorrect. While ACLs can be used for access control, they do not enforce encryption or HTTPS requirements.
- E. Incorrect.
Incorrect. AWS WAF is not designed to directly protect S3 buckets, and it cannot enforce HTTPS connections to S3.