SCS-C02 Question 420
Single answerA company is using Amazon S3 to store sensitive financial documents. The security team requires that all objects in the bucket be encrypted using server-side encryption with AWS Key Management Service (AWS KMS). Additionally, they want to ensure that objects uploaded to this bucket without encryption are automatically rejected. Which solution should you implement to meet these requirements?
- A
Enable S3 bucket default encryption using an AWS KMS key and apply an S3 bucket policy that denies unencrypted object uploads.
- B
Enable S3 bucket default encryption using an AWS KMS key and configure an IAM policy to enforce encryption on object uploads.
- C
Enable S3 bucket default encryption using an AWS KMS key and enable S3 Block Public Access settings.
- D
Configure an S3 bucket policy to explicitly require the 'x-amz-server-side-encryption' header with the value 'aws:kms' for all uploads.
Show answer and explanation
Correct answer: A
Explanation
To meet the security team's requirements, you need a solution that both enforces encryption and rejects unencrypted uploads. Enabling S3 bucket default encryption ensures that all new objects are encrypted with AWS KMS, while a bucket policy can be used to deny unencrypted uploads entirely. This combination provides a comprehensive solution, ensuring compliance with the encryption mandate.
- A. Correct.
This is the correct solution because enabling default encryption ensures all new objects are encrypted using AWS KMS, and applying an S3 bucket policy to deny unencrypted object uploads prevents non-compliant uploads.
- B. Incorrect.
IAM policies cannot enforce encryption at the bucket level. Instead, bucket policies are designed for such specific S3 configurations.
- C. Incorrect.
S3 Block Public Access settings are used to prevent public access to buckets and objects but do not enforce encryption requirements.
- D. Incorrect.
While configuring an S3 bucket policy to require the 'x-amz-server-side-encryption' header can enforce encryption, it does not automatically encrypt objects, making it less comprehensive than enabling default encryption.