A healthcare provider hosts an application that stores sensitive patient records in an Amazon S3 bucket. An internal security audit reveals that the bucket does not have encryption at rest enabled and that objects can be deleted without additional verification. The security team requires that all stored data must be encrypted and that any permanent deletion of objects must require multi-factor authentication. Which of the following configurations should the Solutions Architect implement to meet these requirements? (Select TWO.)
- Configure default S3 server-side encryption on the bucket using a customer-managed key in AWS Key Management Service (AWS KMS).Cevap
- Enable S3 Versioning on the bucket and configure MFA Delete using the AWS CLI or API with AWS account root user credentials.Cevap
- CConfigure default encryption using the AWS-managed KMS key (aws/s3) and modify its key policy to delegate custom key rotation permissions to IAM administrators.
- DImplement a Service Control Policy (SCP) at the root level of the AWS Organization that grants S3 MFA delete configuration permissions to all administrative IAM users.
- EApply an S3 bucket policy that permits public read access while restricting the s3:DeleteObject action to users who authenticate with an MFA-enabled IAM session.
Cevap
Configure default S3 server-side encryption on the bucket using a customer-managed key in AWS Key Management Service (AWS KMS), and enable S3 Versioning on the bucket and configure MFA Delete using the AWS CLI or API with AWS account root user credentials.
Enabling server-side encryption with a Customer Managed Key ensures that data is protected at rest while allowing administrative control over the key. Enabling versioning with MFA Delete ensures that deletion of versions requires multi-factor authentication, which can only be configured using root account credentials.
Adım Adım Çözüm
Anahtar Kavram
To enhance S3 data protection, use AWS KMS customer-managed keys for flexible encryption management, and configure MFA Delete combined with S3 Versioning using root credentials to prevent unauthorized data loss.