Examkin

Question

Difficulty: MediumEnhancing Data Protection and Compliance

An organization has a document archiving application running on Amazon EC2 instances that uploads sensitive financial records to an Amazon S3 bucket. Currently, the data is encrypted using Amazon S3 managed encryption keys (SSE-S3). To comply with new regulatory requirements, the organization must enforce server-side encryption using an AWS Key Management Service (AWS KMS) customer managed key with key rotation enabled. Additionally, any upload requests that do not specify the correct customer managed key must be rejected. Which combination of actions will meet these compliance requirements with the least operational overhead?

  1. Create an AWS KMS customer managed key and enable automatic key rotation. Configure the S3 bucket's default encryption to use the customer managed key. Apply an S3 bucket policy that denies the s3:PutObject action if the s3:x-amz-server-side-encryption header is not set to aws:kms, or if the s3:x-amz-server-side-encryption-aws-kms-key-id header does not specify the Amazon Resource Name (ARN) of the customer managed key.Answer
  2. B
    Configure the S3 bucket's default encryption to use the default AWS-managed KMS key (aws/s3). Access the AWS KMS console to enable automatic annual key rotation and modify the key policy of the AWS-managed KMS key to restrict usage permissions only to the EC2 application instance's IAM role.
  3. C
    Create an AWS KMS customer managed key and enable automatic key rotation. Create an AWS Organizations Service Control Policy (SCP) that denies s3:PutObject unless the customer managed key is specified, and attach it to the member account's Organizational Unit (OU) to grant the application instances the required KMS permissions without modifying their local IAM policies.
  4. D
    Create an AWS KMS customer managed key and enable automatic key rotation. Apply an S3 bucket policy that permits global cross-account uploads by setting the Principal to wildcard (*), but omit explicit principal constraints or KMS key validation, relying on the application's client-side configuration to specify the correct key ARN.

Answer

Create an AWS KMS customer managed key and enable automatic key rotation, update the default encryption of the S3 bucket to use this key, and implement an S3 bucket policy that denies s3:PutObject requests unless they specify the correct customer managed key via headers.
The correct option correctly details setting up a customer managed key with rotation enabled, using it as the default S3 bucket encryption mechanism, and implementing a bucket policy that checks headers to enforce the specific customer managed key. This enforces data protection controls at the bucket level.

Step-by-Step Solution

1
Provision an AWS KMS customer managed key and enable key rotation.
A dedicated KMS key is created that automatically rotates its key material annually, satisfying compliance constraints.
Customer managed keys allow custom policies and cross-account access configuration, unlike AWS-managed keys.
2
Set the S3 bucket default encryption to use the newly created customer managed key.
Unencrypted objects uploaded without explicit headers will default to using this customer managed key.
Provides a default baseline security configuration for the bucket.
3
Attach a bucket policy that denies s3:PutObject if the server-side encryption headers do not match aws:kms or the target KMS key ARN.
Any uploads attempting to write objects using SSE-S3 or an incorrect KMS key are explicitly blocked at the bucket level.
Enforces strict compliance requirements directly on the storage resource.

Key Concept

Enforcing SSE-KMS encryption on Amazon S3 buckets using customer managed keys and bucket policies to satisfy security compliance standards.
Rate this question

Topics

Enhancing Data Protection and Compliance