Examkin

Question

Difficulty: HardEnhancing Data Protection and Compliance

A logistics company has an existing application that stores customer delivery signatures and shipping manifests in an Amazon S3 bucket. The bucket is currently configured with Server-Side Encryption with Amazon S3 managed keys (SSE-S3). Due to new regulatory compliance mandates, the company must enhance its data protection posture by meeting the following requirements:
- All data must be encrypted using a key that supports automatic annual rotation.
- Detailed audit logs of all encryption and decryption operations must be centralized in a dedicated security monitoring AWS account.
- The system must minimize the volume of KMS API requests to avoid throttling errors during peak hours when a high volume of documents are uploaded.
- Any attempt to upload objects using incorrect encryption configurations or without encryption must be blocked.

Which combination of actions should the Solutions Architect implement to meet these requirements with the least operational overhead?

  1. Create a customer managed key (CMK) in AWS KMS within the application account, enable automatic key rotation, and configure the S3 bucket's default encryption to use this KMS key. Enable S3 Bucket Keys on the S3 bucket. Configure AWS CloudTrail to log S3 data events and KMS key management events, delivering them to a centralized S3 bucket in the security account. Add a bucket policy to the S3 bucket that denies s3:PutObject requests if the x-amz-server-side-encryption header is present and not set to aws:kms.Answer
  2. B
    Configure the S3 bucket default encryption to use the AWS-managed KMS key (aws/s3). Enable S3 Bucket Keys on the S3 bucket. Modify the key policy of the AWS-managed KMS key to delegate cross-account audit permissions to the centralized security account, and configure CloudTrail logging. Attach an organization-level Service Control Policy (SCP) that explicitly grants s3:PutObject permissions to allow uploads using this KMS key.
  3. C
    Create a customer managed key (CMK) in AWS KMS, enable automatic key rotation, and set the S3 bucket default encryption to use this key. Disable S3 Bucket Keys to ensure each object access generates a separate KMS decryption audit log in CloudTrail. Configure CloudTrail to deliver logs to the security account's S3 bucket using a bucket policy that allows the CloudTrail principal but lacks aws:SourceArn or aws:SourceAccount condition checks.
  4. D
    Create a customer managed key (CMK) in AWS KMS and enable automatic key rotation. Disable default S3 bucket encryption. Attach a Service Control Policy (SCP) to the application account's OU that explicitly grants s3:PutObject permissions when the KMS key is specified, assuming this SCP replaces the need for bucket policies or local IAM permissions. Configure the application to encrypt files locally before uploading to S3.

Answer

Create a customer managed key in AWS KMS with automatic rotation enabled, configure default S3 bucket encryption with this key, enable S3 Bucket Keys to minimize KMS request volume, centralize CloudTrail logs in the security account, and use an S3 bucket policy to deny uploads that do not specify SSE-KMS.
The correct solution uses a customer managed KMS key to support automatic annual rotation and allow custom policy delegation. Enabling S3 Bucket Keys caches bucket-level keys to significantly reduce KMS API requests and avoid throttling. S3 data events and KMS management events are logged via CloudTrail to a centralized bucket in the security account. The S3 bucket policy ensures that clients cannot override the default encryption with unencrypted requests or SSE-S3 headers.

Step-by-Step Solution

1
Create a customer managed KMS key in the application account and enable automatic key rotation.
Establishes a cryptographically secure key under customer control that automatically rotates yearly, meeting compliance requirements.
AWS-managed keys do not support custom rotation configurations or key policy changes for cross-account access.
2
Enable S3 Bucket Keys and configure the S3 bucket's default encryption to use the newly created customer managed KMS key.
Ensures all newly written objects are encrypted using the customer managed KMS key and drastically reduces the volume of KMS API requests.
S3 Bucket Keys cache bucket-level keys, reducing KMS request traffic by up to 99% and preventing API throttling during high-volume uploads.
3
Configure AWS CloudTrail in the application account to deliver data and management logs to a centralized, secured S3 bucket in the security monitoring account.
Creates a secure, immutable audit trail of all bucket access and KMS operations in a separate administrative domain.
Separating audit trails to a dedicated security account prevents tamper risk and complies with strict auditing frameworks.
4
Apply a bucket policy to the S3 bucket denying s3:PutObject requests that contain encryption headers other than aws:kms.
Enforces encryption standards at the bucket level, preventing clients from uploading unencrypted data or using weaker SSE-S3 encryption.
Default encryption handles requests without headers, but a explicit deny policy prevents clients from explicitly overriding default settings with non-compliant encryption methods.

Key Concept

Combining S3 Bucket Keys, Customer Managed KMS Keys, S3 Bucket Policies, and Centralized CloudTrail logging to satisfy strict data protection, audit, and performance scalability requirements.
Estimated Time:2m 30s
Rate this question

Topics

Enhancing Data Protection and Compliance