SCS-C02 Question 357
Select 2Your organization is using Amazon S3 to store sensitive data. To ensure compliance and prevent unauthorized access, the organization wants to enforce encryption at rest for all objects uploaded to S3 buckets. Additionally, they want to ensure that only AWS Key Management Service (KMS) managed keys are used. Which of the following steps should be taken to meet these requirements?
- A
Enable default encryption on the S3 buckets and set it to use SSE-KMS.
- B
Create an S3 bucket policy that denies any PUT requests without the x-amz-server-side-encryption header set to AES256.
- C
Create an S3 bucket policy that denies any PUT requests without the x-amz-server-side-encryption header set to aws:kms.
- D
Enable S3 Object Lock to enforce write-once-read-many (WORM) compliance.
- E
Use an S3 lifecycle policy to transition unencrypted objects to Glacier and re-encrypt them.
Show answer and explanation
Correct answers: A, C
Explanation
To ensure compliance and enforce encryption at rest using AWS KMS-managed keys in S3, two key actions are required: enabling default encryption on the bucket to use SSE-KMS, and implementing a bucket policy to deny any PUT requests that do not specify KMS encryption (aws:kms). These two measures collectively guarantee that all objects are encrypted with KMS keys and meet the organization's requirements.
- A. Correct.
Correct: Enabling default encryption on the S3 bucket and setting it to SSE-KMS ensures that all new objects uploaded to the bucket are encrypted at rest using AWS Key Management Service managed keys.
- B. Incorrect.
Incorrect: While this denies uploads without encryption, it enforces AES256 encryption, which does not use AWS KMS managed keys and does not meet the specified requirement.
- C. Correct.
Correct: This bucket policy ensures that objects are only uploaded if they are encrypted with server-side encryption using KMS (aws:kms), meeting the stated requirement for KMS-managed keys.
- D. Incorrect.
Incorrect: S3 Object Lock enforces write-once-read-many (WORM) compliance, which is unrelated to the requirement of enforcing encryption with KMS keys.
- E. Incorrect.
Incorrect: S3 lifecycle policies manage object transitions between storage classes and don't enforce encryption for objects being uploaded to the bucket.