SOA-C02 Question 169
Select 3Your organization requires that all S3 buckets storing sensitive data must be encrypted and access must be restricted to specific IAM roles. As the SysOps Administrator, you need to ensure compliance with this policy. Which combination of actions should you take to meet this requirement?
- A
Enable default encryption on the S3 buckets using an AWS KMS-managed key
- B
Use an S3 bucket policy to explicitly deny access to all principals except specific IAM roles
- C
Enable versioning on the S3 bucket to track changes to stored objects
- D
Use AWS Config to create a compliance rule that checks for S3 bucket encryption
- E
Configure an S3 Lifecycle policy to delete unencrypted objects after 30 days
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the security and compliance requirements, you must ensure the S3 bucket is encrypted and access is limited to specific IAM roles. Enabling default encryption ensures all objects are encrypted by default, while a bucket policy enforces access restrictions to specific roles. AWS Config can be used to monitor compliance with encryption policies. These combined actions address encryption and access control requirements comprehensively.
- A. Correct.
Enabling default encryption ensures that all new objects uploaded to the bucket are encrypted automatically, meeting the encryption requirement.
- B. Correct.
Using a bucket policy to restrict access ensures that only specific IAM roles can access the bucket, which is necessary to meet the access restriction requirement.
- C. Incorrect.
Enabling versioning is helpful for data recovery and tracking changes but does not directly address encryption or access control requirements.
- D. Correct.
AWS Config allows you to evaluate compliance by creating a rule that checks if S3 buckets are encrypted, helping maintain ongoing compliance.
- E. Incorrect.
An S3 Lifecycle policy for deleting unencrypted objects does not meet the requirement for ensuring encryption and would not actively prevent non-compliance.