DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  s3:x-amz-server-side-encryption with value 'aws:kms'

  Why it's wrong here

  This condition `s3:x-amz-server-side-encryption` only validates that server-side encryption with AWS KMS (SSE-KMS) is being used for the object upload. While it ensures encryption via KMS, it does not provide any mechanism to specify or enforce the use of a particular customer-managed key (CMK). Therefore, any KMS key, including the default S3-managed KMS key or another CMK accessible to the uploader, would satisfy this condition, failing to meet the requirement for a *specific* key.

• ✓

  s3:x-amz-server-side-encryption-aws-kms-key-id with value 'arn:aws:kms:us-east-1:123456789012:key/1234-5678'

  Why this is correct

  The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition directly enforces the use of a specific AWS KMS key by comparing its ARN against the value provided in the S3 PUT object request header. This precise condition ensures that only objects encrypted with the designated customer-managed key (CMK) are successfully uploaded to the bucket. It provides the granular control necessary to meet strict compliance requirements for sensitive data, ensuring data at rest is secured with an auditable, pre-approved key.

• ✗

  s3:x-amz-acl with value 'bucket-owner-full-control'

  Why it's wrong here

  The `s3:x-amz-acl` condition key is used to control the Access Control List (ACL) settings applied to an object during an S3 upload operation. For instance, setting it to 'bucket-owner-full-control' ensures that the bucket owner gains full control over objects uploaded by other AWS accounts. However, this condition is entirely unrelated to server-side encryption methods or the specific KMS key used for data protection, focusing solely on object ownership and permissions.

• ✗

  aws:SourceArn with value the bucket ARN

  Why it's wrong here

  The `aws:SourceArn` condition key is primarily utilized in resource-based policies to mitigate the confused deputy security problem by restricting which AWS services or resources can invoke actions on the policy's target resource. It ensures that requests originate from an expected source, such as a specific Lambda function or S3 bucket. This condition does not, however, govern or enforce any aspects of server-side encryption, including the type of encryption or the specific KMS key employed for data at rest.

Go deeper

Related to this question