SCS-C02 Question 488
Single answerYour organization uses Amazon S3 to store sensitive customer information. Compliance regulations dictate that the data must be encrypted both in transit and at rest. You have been tasked with ensuring that all uploaded objects to the S3 bucket are encrypted using server-side encryption with AWS Key Management Service (AWS KMS) customer-managed keys. How can you enforce this requirement with minimal administrative overhead?
- A
Enable S3 bucket default encryption and choose AWS KMS as the encryption method.
- B
Use an AWS Config rule to monitor S3 bucket encryption and manually remediate non-compliant objects.
- C
Create an S3 bucket policy that denies uploads unless the x-amz-server-side-encryption header is set to 'aws:kms'.
- D
Enable S3 Transfer Acceleration to ensure data is encrypted in transit and specify encryption headers in application code.
Show answer and explanation
Correct answer: A
Explanation
Enabling default encryption on the S3 bucket with AWS KMS customer-managed keys ensures compliance with encryption requirements for data at rest with minimal administrative effort. This option is the most straightforward and reliable solution for enforcing encryption without requiring additional policies or application code changes.
- A. Correct.
This is the correct answer. Enabling default encryption on the S3 bucket with AWS KMS ensures that all new objects are automatically encrypted with the specified KMS key without requiring changes to application code or additional policies.
- B. Incorrect.
While an AWS Config rule can detect non-compliant objects, it requires manual remediation or an automated remediation workflow to enforce compliance, which adds unnecessary administrative overhead.
- C. Incorrect.
An S3 bucket policy can enforce the x-amz-server-side-encryption header, but it requires additional configuration and may lead to application errors if the header is not properly set by clients.
- D. Incorrect.
S3 Transfer Acceleration improves upload speeds but does not inherently enforce encryption at rest. Specifying encryption headers in application code is error-prone and adds complexity.