DEA-C01 Data Store Management Practice Question

A company stores sensitive data in an S3 bucket. To meet compliance requirements, they must ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. Which bucket policy statement should be applied to deny uploads that do not use the required encryption?

⚠ Common exam trap

Watch out — candidates often confuse the condition keys for encryption type (`s3:x-amz-server-side-encryption`) with the specific KMS key ID (`s3:x-amz-server-side-encryption-aws-kms-key-id`), or mistakenly use `Null` to check for the presence of encryption instead of enforcing the correct encryption algorithm.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}

It uses the `s3:x-amz-server-side-encryption` condition key with `StringNotEquals` set to `aws:kms`, which denies any `s3:PutObject` request where the encryption header does not specify `aws:kms`. This ensures all uploaded objects are encrypted at rest using server-side encryption with AWS KMS, meeting the compliance requirement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}
Why this is correct
The `StringNotEquals` condition on `s3:x-amz-server-side-encryption` denies any `PutObject` request whose encryption header is not `aws:kms`, directly enforcing the compliance requirement that all objects use SSE-KMS. Unlike `StringNotEqualsIfExists`, this operator also blocks uploads that omit the header entirely, closing the unencrypted-upload gap.
✗
{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}
Why it's wrong here
StringNotEquals on AES256 denies every request whose header is not AES256, including the required aws:kms value, so compliant KMS uploads are blocked. It is tempting because AES256 is valid server-side encryption, and would be correct when SSE-S3 rather than SSE-KMS is the mandated encryption mode.
✗
{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/abc123"}}}
Why it's wrong here
Conditioning on the KMS key ID alone does not verify the encryption algorithm; a request using AES256 or a different key could still satisfy the key-ID check, so SSE-KMS is not guaranteed. It is tempting to pin a specific CMK, and would be correct when restricting uploads to one approved key is the sole control needed.
✗
{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucketname/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}
Why it's wrong here
The Null condition with value true matches requests where the encryption header is absent, so uploads specifying AES256 or aws:kms still succeed, and it never enforces the KMS key. It is tempting as a way to require some encryption header, and would be correct when only the presence of any encryption declaration must be enforced.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Store Management Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question