A company has several Amazon S3 buckets that do not enforce encryption in transit. A security engineer must implement a solution that enforces encryption in transit for all the company's existing…

Question

Options

• AEnable AWS Config. Create a proactive AWS Config Custom Policy rule. Create a Guard clause
• BEnable AWS Config. Configure the s3-bucket-ssl-requests-only AWS Config managed rule and
• CEnable Amazon Inspector. Create a custom AWS Lambda rule. Create a Lambda function that
• DCreate an AWS CloudTrail trail. Enable S3 data events on the trail. Create an AWS Lambda

• A
  4% (1)
• B
  85% (22)
• C
  8% (2)
• D
  4% (1)

Explanation

To enforce encryption in transit for Amazon S3, AWS best practice is to require HTTPS (TLS) by using a bucket policy condition that denies any request where aws:SecureTransport is false. The requirement includes both existing buckets and future buckets, so the control must continuously evaluate configuration drift and automatically remediate. AWS Config is the service intended for continuous configuration compliance monitoring across resources, and AWS Config managed rules provide standardized checks with low operational overhead. The s3-bucket-ssl-requests- only managed rule evaluates whether S3 buckets enforce SSL-only requests, aligning directly with enforcing encryption in transit. Setting the trigger type to Hybrid ensures evaluation both on configuration changes and periodically. Automatic remediation with an AWS Systems Manager Automation runbook allows the organization to apply or correct the bucket policy consistently at scale without manual work. This approach also supports governance by maintaining a measurable compliance status while actively fixing noncompliance. Option A is not the best fit because a "proactive" custom policy rule does not by itself remediate existing buckets and "block resource creation" is not how AWS Config enforces controls. Option C is incorrect because Amazon Inspector is a vulnerability management service and does not govern S3 bucket transport policies. Option D is inefficient and indirect because CloudTrail data events are not a compliance engine and would require custom processing.

No community discussion yet for this question.