SCS-C02 Question 323
Single answerAn organization uses Amazon S3 to store sensitive customer data. The security team wants to ensure that all objects stored in the S3 bucket are encrypted and that no unencrypted objects can ever be uploaded, even accidentally. What is the most effective way to enforce this requirement?
- A
Enable default encryption on the S3 bucket and configure the bucket policy to deny unencrypted object uploads.
- B
Enable Amazon Macie to monitor the S3 bucket for unencrypted objects and notify the security team.
- C
Use AWS Config to monitor the bucket for unencrypted objects and automatically remediate them using AWS Lambda.
- D
Apply a lifecycle policy on the S3 bucket to delete unencrypted objects immediately after upload.
Show answer and explanation
Correct answer: A
Explanation
To ensure that all objects in an S3 bucket are encrypted and prevent unencrypted objects from being uploaded, the best solution is to combine default encryption with a bucket policy that explicitly denies uploads of unencrypted objects. This approach provides both automatic encryption for new objects and a preventive enforcement mechanism.
- A. Correct.
This is the correct answer. Enabling default encryption ensures that all new objects are encrypted by default, while the bucket policy adds an extra layer of enforcement by denying uploads of unencrypted objects.
- B. Incorrect.
Amazon Macie is a data discovery and classification tool, but it cannot enforce encryption requirements or prevent unencrypted uploads.
- C. Incorrect.
AWS Config can be used to monitor compliance, but it does not directly prevent unencrypted objects from being uploaded. Automatic remediation using AWS Lambda adds complexity and is not the most effective preventive measure.
- D. Incorrect.
A lifecycle policy cannot prevent uploads of unencrypted objects; it can only manage the lifecycle of objects already stored in the bucket.