SOA-C02 · Question #748
A SysOps administrator needs to create an Amazon S3 bucket as a resource in an AWS CloudFormation template. The bucket name must be randomly generated. The bucket must be encrypted by an AWS Key…
The correct answer is B. Bucket: Type: AWS::S3::Bucket Properties: BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: 'aws:kms' KMSMasterKeyID: KMS-KEY-ARN BucketKeyEnabled: true. Option B is correct because it omits the BucketName property entirely, which causes CloudFormation to auto-generate a unique, random bucket name - satisfying the 'randomly generated' requirement. It also uses the correct nested CloudFormation syntax for KMS encryption…
Question
A SysOps administrator needs to create an Amazon S3 bucket as a resource in an AWS CloudFormation template. The bucket name must be randomly generated. The bucket must be encrypted by an AWS Key Management Service (AWS KMS) key. Other resources in the template will reference the bucket. Which CloudFormation resource definition should the SysOps administrator use to meet these requirements? A. B. C. D.
Exhibits
Options
- ABucket: Type: AWS::S3::Bucket Properties: - ServerSideEncryptionConfiguration: 'aws:kms'
- BBucket: Type: AWS::S3::Bucket Properties: BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: 'aws:kms' KMSMasterKeyID: KMS-KEY-ARN BucketKeyEnabled: true
- CBucket: Type: AWS::S3::Bucket Properties: BucketName: 'DOC-EXAMPLE-BUCKET' BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: 'aws:kms' KMSMasterKeyID: KMS-KEY-ARN BucketKeyEnabled: true
- DBucket: Type: AWS::S3::Bucket Properties: BucketName: !Select [ '0', [ 'Default']] BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: 'aws:kms' KMSMasterKeyID: KMS-KEY-ARN BucketKeyEnabled: true
How the community answered
(23 responses)- B78% (18)
- C9% (2)
- D13% (3)
Explanation
Option B is correct because it omits the BucketName property entirely, which causes CloudFormation to auto-generate a unique, random bucket name - satisfying the 'randomly generated' requirement. It also uses the correct nested CloudFormation syntax for KMS encryption (BucketEncryption → ServerSideEncryptionConfiguration → ServerSideEncryptionByDefault with SSEAlgorithm: 'aws:kms'), and since it uses a logical resource name ('Bucket'), other resources in the template can reference it using !Ref or !GetAtt.
Topics
Community Discussion
No community discussion yet for this question.