DVA-C02 Practice Question: s3:x-amz-server-side-encryption-aws-kms-key-id…
A company wants to enforce that all uploads to an Amazon S3 bucket must be encrypted using server-side encryption with a specific AWS KMS customer managed key (CMK). The developer needs to write an IAM policy condition that denies any s3:PutObject request that does not use the specified KMS key. Which IAM condition key should be used?
⚠ Common exam trap
Watch out — candidates often confuse the condition key for enforcing encryption type (Option A) with the condition key for enforcing a specific KMS key ID (Option C), or mistakenly think that a KMS-specific condition key like `kms:KeyArn` can be used in an S3 policy, when in fact it only applies to KMS API calls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:x-amz-server-side-encryption-aws-kms-key-id
The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows you to enforce that a specific AWS KMS customer managed key (CMK) ARN is used for server-side encryption on S3 PutObject requests. By using this condition key in a Deny statement, you can reject any upload that does not specify the required KMS key ID, ensuring encryption compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
s3:x-amz-server-side-encryption
Why it's wrong here
This condition key evaluates the presence and type of server-side encryption specified in the x-amz-server-side-encryption request header, such as AES256 or aws:kms. While it can enforce that *some* form of SSE is used for uploads, it does not provide the granularity to specify a particular AWS KMS customer master key (CMK) by its ARN or ID. Therefore, it cannot enforce uploads to use a *specific* KMS key, only that SSE is enabled.
- ✗
kms:EncryptionContext
Why it's wrong here
The kms:EncryptionContext condition key is exclusively used within AWS KMS key policies to control access based on the encryption context provided during KMS cryptographic operations. It is not a condition key that can be evaluated directly within an Amazon S3 bucket policy for s3:PutObject actions. S3 bucket policies operate on S3-specific request headers and attributes, not directly on KMS encryption context details.
- ✓
s3:x-amz-server-side-encryption-aws-kms-key-id
Why this is correct
This is the correct condition key to enforce the use of a specific AWS KMS customer master key (CMK) for server-side encryption on S3 uploads. It directly evaluates the value provided in the x-amz-server-side-encryption-aws-kms-key-id request header during a PutObject operation. By specifying a particular KMS key ARN with this condition, an S3 bucket policy can deny any upload requests that do not include or match the designated CMK.
- ✗
kms:KeyArn
Why it's wrong here
The kms:KeyArn condition key is used within an AWS KMS key policy to restrict access to the KMS key itself based on its ARN. It is not a condition key that can be applied within an Amazon S3 bucket policy to control s3:PutObject actions. S3 bucket policies evaluate S3-specific request attributes, and while S3 interacts with KMS, the kms:KeyArn condition is not available for direct enforcement within an S3 policy context.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.