DOP-C02 · Question #381
A company uses an organization in AWS Organizations to manage many AWS accounts. The company has enabled all features for the organization. The company uses AWS CloudFormation StackSets to deploy conf
The correct answer is D. Create an SCP that includes a deny statement for the s3:putObject action and a condition where. A Service Control Policy (SCP) is the best way to enforce security requirements across all AWS accounts in an organization. To ensure that all object uploads to the S3 bucket use AWS KMS encryption, the SCP should deny the s3:PutObject action unless the request specifies s3:x-amz
Question
A company uses an organization in AWS Organizations to manage many AWS accounts. The company has enabled all features for the organization. The company uses AWS CloudFormation StackSets to deploy configurations to the accounts. The company uses AWS Config to monitor an Amazon S3 bucket. The company needs to ensure that all object uploads to the S3 bucket use AWS Key Management Service (AWS KMS) encryption. Which solution will meet these requirements?
Options
- ACreate an AWS Config conformance pack that includes the s3-bucket-server-side-encryption-
- BCreate an SCP that includes a deny statement for the s3:createBucket action and a condition
- CCreate an AWS CloudFormation stack set to enable an AWS CloudTrail trail to capture S3 data
- DCreate an SCP that includes a deny statement for the s3:putObject action and a condition where
How the community answered
(39 responses)- A15% (6)
- B26% (10)
- C8% (3)
- D51% (20)
Explanation
A Service Control Policy (SCP) is the best way to enforce security requirements across all AWS accounts in an organization. To ensure that all object uploads to the S3 bucket use AWS KMS encryption, the SCP should deny the s3:PutObject action unless the request specifies s3:x-amz-server-side-encryption=aws:kms. By attaching the SCP at the root of the organization, the policy will apply to all AWS accounts, ensuring that no user in any account can upload objects without using AWS KMS encryption.
Topics
Community Discussion
No community discussion yet for this question.