SCS-C02 Question 370
Select 2Your organization uses Amazon S3 to store sensitive financial data. You are tasked with ensuring that only users from your company's AWS account can access a specific S3 bucket. Additionally, all requests to the bucket must be encrypted using SSE-KMS with a specific KMS key. Which of the following resource policy statements would achieve this requirement?
- A
Allow access to the bucket only if the request originates from the specified AWS account and uses SSE-KMS with the specified KMS key.
- B
Allow access to the bucket for any AWS account, as long as encryption with SSE-KMS using the specified KMS key is enabled.
- C
Deny access to the bucket unless the request is encrypted with SSE-KMS using the specified KMS key and originates from the specified AWS account.
- D
Allow all IAM users from the specified AWS account to access the bucket without enforcing encryption requirements.
Show answer and explanation
Correct answers: A, C
Explanation
To satisfy the scenario, the resource policy must enforce two conditions: restrict access to users from the specified AWS account and require encryption using SSE-KMS with the specified KMS key. Option 1 ensures these requirements are met by allowing access only under these conditions. Option 3 strengthens security by explicitly denying access if the conditions are not met. Combining these statements provides a robust security control for sensitive financial data.
- A. Correct.
This option is correct because it ensures that only users from the specified AWS account can access the bucket, and it enforces the use of SSE-KMS with the specified KMS key.
- B. Incorrect.
This option is incorrect because it allows access from any AWS account, which violates the requirement to restrict access to your organization’s account only.
- C. Correct.
This option is correct because it explicitly denies access unless both conditions are met: the request originates from the specified AWS account and uses SSE-KMS with the specified KMS key.
- D. Incorrect.
This option is incorrect because it allows access without enforcing encryption requirements, which does not meet the requirement to use SSE-KMS with the specified KMS key.