SCS-C02 Question 287
Single answerYour company uses an Amazon S3 bucket to store sensitive financial data. To comply with regulatory requirements, you must ensure all objects stored in the bucket are encrypted, and only approved encryption methods are used. How can you achieve this in the most secure and automated way?
- A
Enable default encryption on the S3 bucket and configure it to use server-side encryption with AWS Key Management Service (SSE-KMS).
- B
Manually encrypt each object before uploading it to the S3 bucket using a client-side encryption library.
- C
Attach an IAM policy to the S3 bucket that enforces the use of SSL/TLS during data transfer.
- D
Apply an S3 bucket policy that denies any PUT request not using server-side encryption with a specific KMS key.
Show answer and explanation
Correct answer: D
Explanation
The most secure and automated way to enforce encryption of objects in an S3 bucket is by applying a bucket policy that denies PUT requests not using server-side encryption with a specific AWS KMS key. This approach ensures that only encrypted objects that comply with your regulatory requirements are stored in the bucket. While enabling default encryption is a good practice, it does not enforce encryption for all uploads unless combined with a bucket policy.
- A. Incorrect.
While enabling default encryption with SSE-KMS ensures encryption of objects, it does not enforce encryption for objects uploaded without default encryption explicitly applied. This is not the most secure and automated solution.
- B. Incorrect.
Encrypting objects manually with a client-side encryption library can ensure encryption, but it requires significant application-level management and is not automated at the bucket level.
- C. Incorrect.
Using SSL/TLS ensures secure data transfer to the bucket but does not enforce encryption of the data at rest in the S3 bucket.
- D. Correct.
A bucket policy that denies PUT requests without server-side encryption using a specific KMS key ensures only encrypted objects are stored in the bucket, meeting compliance requirements in a secure and automated manner.