A company stores sensitive financial reports in an Amazon S3 bucket. The company's security policy mandates that all objects be encrypted at rest using an AWS KMS customer-managed key. The security team wants to ensure that only the 'Auditors' IAM role can decrypt the objects, even though the S3 bucket policy allows read access to a broader set of users. Which of the following steps must the security team take to enforce this access control?

Configure an S3 bucket policy that denies s3:GetObject requests unless the request is encrypted in transit using HTTPS.

This enforces HTTPS for all requests but does not prevent unauthorized decryption of objects. A user who has s3:GetObject permission via the bucket policy can still download the encrypted object, and if they have kms:Decrypt permission, they could decrypt it. This option does not address the requirement to restrict decryption.

Enable S3 Block Public Access on the bucket and attach an IAM policy to the 'Auditors' role that allows s3:GetObject.

Block Public Access and IAM policies control who can read the objects from S3, but they do not control who can decrypt objects encrypted with a KMS key. Any principal with s3:GetObject permission could download the encrypted object; the KMS key policy then determines if they can decrypt it. This option does not restrict decryption to only the 'Auditors' role.

Use S3 object-level logging to monitor access and revoke permissions for any role that attempts to decrypt objects without authorization.

This is a reactive, detective control, not a preventive one. It does not enforce that only the 'Auditors' role can decrypt objects. Unauthorized decryption could occur before revocation. The requirement is to enforce access control, not just monitor it.

What does this CLF-C02 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Configure the S3 bucket to use SSE-KMS encryption with the customer-managed key, and modify the KMS key policy to grant the kms:Decrypt permission only to the 'Auditors' role. — To enforce that only a specific IAM role can decrypt objects encrypted with a customer-managed KMS key, you must control the kms:Decrypt permission. SSE-KMS encryption uses a KMS key to encrypt/decrypt objects. The KMS key policy determines who can use the key to decrypt. By granting kms:Decrypt only to the 'Auditors' role in the key policy, even if the S3 bucket policy allows s3:GetObject to others, they cannot decrypt the object without the key permission. Option B is incorrect because it enforces HTTPS, not decryption control. Option C is incorrect because S3 Block Public Access and IAM policies do not control KMS decryption permissions. Option D is incorrect because it is a detective control, not a preventive one.

What should I do if I get this CLF-C02 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.