SOA-C02 Question 201
Select 2Your organization has implemented a data classification scheme requiring resources to be tagged as 'Confidential', 'Internal', or 'Public'. You need to ensure that S3 buckets storing 'Confidential' data have server-side encryption enabled and are not publicly accessible. Which combination of actions should you take to enforce this policy?
- A
Use AWS Config with a managed rule to check if S3 buckets with the 'Confidential' tag have server-side encryption enabled.
- B
Enable S3 bucket versioning to protect data integrity for buckets tagged as 'Confidential'.
- C
Use an S3 bucket policy to explicitly deny public access to buckets tagged as 'Confidential'.
- D
Set up an AWS Lambda function triggered by S3 events to log access to buckets tagged as 'Confidential'.
- E
Create an IAM policy that denies actions on S3 buckets tagged as 'Confidential' if they are not encrypted.
Show answer and explanation
Correct answers: A, C
Explanation
To enforce the data classification scheme, AWS Config can be used to monitor and ensure compliance with encryption policies, while an S3 bucket policy can enforce restrictions on public access. Together, these solutions address the requirements for buckets tagged as 'Confidential'.
- A. Correct.
This is correct because AWS Config can monitor compliance with encryption requirements for S3 buckets based on defined tags like 'Confidential'.
- B. Incorrect.
While versioning is a good practice, it does not directly enforce the required data classification scheme or ensure encryption or access restrictions.
- C. Correct.
This is correct because an S3 bucket policy can explicitly deny public access to buckets tagged as 'Confidential', ensuring compliance with the classification scheme.
- D. Incorrect.
Logging access is useful for auditing but does not enforce encryption or public access restrictions.
- E. Incorrect.
IAM policies cannot enforce conditional encryption based on tags in the way described. AWS Config or bucket policies are better suited for this use case.