SOA-C02 Question 211
Single answerYour organization stores sensitive data in Amazon S3 buckets and must ensure that the data is encrypted at rest using AWS Key Management Service (AWS KMS) managed keys. As part of compliance, you need to configure the bucket so that no object can be uploaded unless it is encrypted with the correct AWS KMS key. Which of the following is the correct configuration to meet this requirement?
- A
Enable default encryption with the specified AWS KMS key and create a bucket policy that denies uploads without encryption.
- B
Enable server-side encryption (SSE-S3) and set a lifecycle policy to transition unencrypted objects to encrypted storage.
- C
Enable versioning and create a bucket policy that requires object versions to be encrypted.
- D
Enable default encryption with the specified AWS KMS key and set up an S3 Event Notification to monitor unencrypted object uploads.
Show answer and explanation
Correct answer: A
Explanation
To ensure encryption at rest with AWS KMS keys, you must configure default encryption on the bucket with the desired AWS KMS key and enforce the policy using a bucket policy. The bucket policy ensures that no unencrypted objects are uploaded, meeting compliance requirements.
- A. Correct.
This is correct. Enabling default encryption with the specified AWS KMS key ensures all new objects are encrypted with that key. Adding a bucket policy that denies uploads without encryption provides additional enforcement.
- B. Incorrect.
This is incorrect. SSE-S3 uses Amazon S3-managed keys, not AWS KMS keys, and a lifecycle policy cannot retroactively encrypt unencrypted objects.
- C. Incorrect.
This is incorrect. While versioning is useful for keeping object versions, it does not enforce encryption requirements for uploads.
- D. Incorrect.
This is incorrect. S3 Event Notifications are used for event-driven actions but do not enforce encryption or prevent unencrypted object uploads.