SCS-C02 Question 304
Single answerA company stores sensitive customer data in an Amazon S3 bucket. To comply with regulatory requirements, the company must ensure that all objects uploaded to the bucket are encrypted. Additionally, they want to minimize the risk of misconfigured encryption settings by developers. What is the most secure way to enforce this requirement?
- A
Use an S3 bucket policy that denies any PutObject request without server-side encryption enabled.
- B
Enable default encryption on the S3 bucket with SSE-S3.
- C
Use AWS Key Management Service (KMS) and require client-side encryption for all objects uploaded to the bucket.
- D
Enable S3 Object Lock in Governance mode and configure a retention period.
Show answer and explanation
Correct answer: A
Explanation
To enforce encryption for all objects uploaded to an S3 bucket and minimize the risk of misconfigurations, using an S3 bucket policy to deny PutObject requests without server-side encryption is the most secure and reliable method. This ensures compliance with regulatory requirements and provides centralized control over encryption settings.
- A. Correct.
This is the most secure and effective approach. An S3 bucket policy denying PutObject requests without server-side encryption ensures that all objects are encrypted and prevents developers from bypassing encryption requirements.
- B. Incorrect.
While enabling default encryption with SSE-S3 ensures all objects are encrypted, it doesn't prevent developers from misconfiguring encryption settings during uploads. A bucket policy provides additional enforcement.
- C. Incorrect.
Requiring client-side encryption ensures encryption but relies on developers to implement it correctly. It also adds complexity for managing encryption keys and processes.
- D. Incorrect.
S3 Object Lock in Governance mode is used for write-once-read-many (WORM) compliance and data retention, but it does not enforce encryption requirements for uploaded objects.