SCS-C02 Question 261
Select 3An organization wants to secure its Amazon S3 bucket that stores sensitive financial records. They require that only specific IAM roles within the organization can access the bucket, and all requests must be encrypted using server-side encryption with AWS Key Management Service (SSE-KMS). Additionally, they want to log all access requests to the bucket for auditing purposes. Which combination of actions should the organization take to meet these requirements?
- A
Create an S3 bucket policy that explicitly allows access only to the specified IAM roles.
- B
Enable S3 server access logging on the bucket to capture all access requests.
- C
Use an S3 bucket policy to enforce the use of server-side encryption with SSE-KMS for all objects.
- D
Enable default encryption for the S3 bucket using SSE-S3.
- E
Enable AWS CloudTrail logging for the S3 bucket to capture API access logs.
Show answer and explanation
Correct answers: A, C, E
Explanation
To meet the organization's requirements, the S3 bucket policy must restrict access to specific IAM roles and enforce server-side encryption with AWS KMS (SSE-KMS). Additionally, enabling AWS CloudTrail logging ensures all access requests are captured at the API level for auditing purposes. While S3 server access logging provides basic access details, it does not meet the detailed logging requirement for auditing. Default encryption with SSE-S3 does not satisfy the specific requirement to use SSE-KMS.
- A. Correct.
Creating an S3 bucket policy that explicitly allows access only to specified IAM roles ensures that only those roles can access the bucket. This satisfies the requirement of restricting access to specific roles.
- B. Incorrect.
Enabling S3 server access logging captures details about requests made to the bucket, but it does not meet the auditing requirement as it does not provide detailed API-level logging.
- C. Correct.
Using an S3 bucket policy to enforce SSE-KMS ensures that all objects in the bucket are encrypted with AWS KMS keys, meeting the encryption requirement.
- D. Incorrect.
Enabling default encryption with SSE-S3 is not sufficient because the requirement specifically mentions the use of server-side encryption with AWS KMS keys (SSE-KMS).
- E. Correct.
Enabling AWS CloudTrail logging provides detailed API-level access logs, satisfying the auditing requirement.