SCS-C02 Question 469
Select 2Your company is using AWS Config to evaluate compliance of resources against a set of organizational policies. Recently, a new policy mandates that all Amazon S3 buckets must have default encryption enabled. You need to ensure compliance with this policy across all S3 buckets in your environment. What steps should you take to achieve this?
- A
Create an AWS Config custom rule using an AWS Lambda function to check for default encryption on S3 buckets.
- B
Enable the managed AWS Config rule 's3-bucket-server-side-encryption-enabled' and associate it with a remediation action to enable encryption.
- C
Manually review all S3 buckets and enable default encryption through the AWS Management Console.
- D
Use AWS Systems Manager Automation Documents (SSM documents) to automatically enable encryption for non-compliant S3 buckets.
- E
Enable AWS CloudTrail to monitor S3 bucket configuration changes and manually enforce compliance.
Show answer and explanation
Correct answers: A, B
Explanation
To ensure compliance with the policy of enabling S3 bucket encryption, AWS Config is the most appropriate service. The managed rule 's3-bucket-server-side-encryption-enabled' can automate compliance checks and remediation, while creating a custom rule allows for customizing compliance evaluations if needed. Manual methods and unrelated services like CloudTrail are not efficient or suitable for this task.
- A. Correct.
This is a valid option because creating a custom rule using AWS Lambda allows you to define specific compliance checks not covered by managed rules. However, this requires additional effort compared to using managed rules.
- B. Correct.
This is a valid option because AWS Config provides a managed rule specifically for checking S3 bucket encryption, and you can configure a remediation action to automatically enable encryption on non-compliant buckets.
- C. Incorrect.
While this approach might work, it is not scalable or automated, and relying on manual actions is not recommended for compliance in large environments.
- D. Incorrect.
AWS Systems Manager can automate tasks, but enabling encryption on S3 buckets is beyond its native capabilities. AWS Config with remediation is better suited for this use case.
- E. Incorrect.
AWS CloudTrail is a logging service used for monitoring API activity and changes, but it is not designed for evaluating or enforcing compliance.