SCS-C02 Question 165
Select 3Your organization is using an S3 bucket to store sensitive financial data. The Chief Information Security Officer (CISO) wants to ensure that any objects uploaded to the bucket are encrypted using server-side encryption with AWS Key Management Service (AWS KMS) keys. Additionally, they require that only the finance department can upload files to this bucket. Which combination of actions should you take to meet these requirements?
- A
Enable default encryption with AWS KMS keys on the S3 bucket
- B
Create a bucket policy that denies any PutObject requests without the
x-amz-server-side-encryptionheader set toaws:kms - C
Use an IAM policy to allow only members of the finance department to upload objects to the S3 bucket
- D
Enable S3 versioning to retain previous versions of uploaded objects
- E
Use an S3 Lifecycle policy to automatically delete objects that are not encrypted
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the requirements, you need to enforce encryption using AWS KMS keys and restrict access to the S3 bucket to only the finance department. Enabling default encryption ensures all objects are encrypted automatically. Adding a bucket policy to deny unencrypted uploads enforces encryption compliance. Finally, an IAM policy ensures that only finance department users can upload objects. S3 versioning and lifecycle policies are not relevant to the specified requirements.
- A. Correct.
Correct. Enabling default encryption with AWS KMS keys on the S3 bucket ensures that all objects are encrypted with the specified KMS key by default.
- B. Correct.
Correct. A bucket policy that denies PutObject requests without the
x-amz-server-side-encryptionheader ensures encryption compliance for objects uploaded to the bucket. - C. Correct.
Correct. Using an IAM policy to limit uploads to the finance department ensures that only authorized users can upload objects to the bucket.
- D. Incorrect.
Incorrect. While S3 versioning is useful for retaining previous versions of objects, it does not address the encryption or access control requirements in this scenario.
- E. Incorrect.
Incorrect. S3 Lifecycle policies are used for managing object storage lifecycles and do not enforce encryption or control access to the bucket.