How to Enforce KMS Encryption for S3 Uploads Using Bucket Policy
A company has an S3 bucket that contains sensitive data. The security team requires that all objects uploaded to the bucket must be encrypted at rest using AWS KMS. Which combination of actions will enforce this?
Quick Answer
The answer is to use a bucket policy that denies PutObject if the `x-amz-server-side-encryption` header is not `aws:kms`. This works because a bucket policy operates at the API level, rejecting any upload that fails to specify KMS encryption, whereas default encryption settings like SSE-S3 can be overridden by the client’s request headers. On the AWS Certified Developer Associate DVA-C02 exam, this concept tests your understanding that bucket policies are the only reliable way to enforce encryption requirements, since client-side headers always take precedence over bucket defaults. A common trap is assuming that enabling default encryption alone is sufficient, but the exam expects you to recognize that a policy with a Deny effect is necessary to block non-compliant uploads. Memory tip: think “Deny the header, enforce the KMS” — if the header isn’t `aws:kms`, the policy slams the door.
⚠ Common exam trap
Candidates often confuse default encryption with enforcement, not realizing that default encryption can be overridden by client-specified headers, whereas a bucket policy with a deny condition is the only way to mandate encryption at the API level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not 'aws:kms'.
A bucket policy that denies PutObject requests when the `x-amz-server-side-encryption` header is not set to `aws:kms` enforces encryption at rest using AWS KMS for all uploads. This policy explicitly rejects any upload that does not include the required KMS encryption header, ensuring compliance with the security team's requirement. Default encryption settings (like SSE-S3 or SSE-KMS) can be overridden by the client, so a bucket policy is the only way to enforce encryption at the API level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the bucket to use SSE-S3 by default.
Why it's wrong here
SSE-S3 does not use KMS.
- ✗
Enable default encryption on the bucket with SSE-KMS.
Why it's wrong here
Default can be overridden by the client.
- ✗
Use a bucket policy that allows only PutObject with KMS encryption.
Why it's wrong here
This would allow only KMS but not deny unencrypted uploads.
- ✓
Use a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not 'aws:kms'.
Why this is correct
This enforces KMS encryption on every upload.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company's S3 bucket contains sensitive data. The security team requires that all data be encrypted at rest. Which combination of actions will enforce encryption for all objects written to the bucket?
medium- ✓ A.Enable default encryption on the bucket and apply a bucket policy that denies PutObject if the x-amz-server-side-encryption header is missing or set to None.
- B.Use bucket ACLs to grant write access only to users who use encryption.
- C.Enable default encryption on the bucket and use bucket ACLs to restrict access.
- D.Create an AWS KMS key and attach a key policy that requires encryption.
Why A: It combines enabling default encryption on the bucket with a bucket policy that denies PutObject requests when the x-amz-server-side-encryption header is missing or set to 'None'. This ensures that any object uploaded without encryption headers is rejected, and default encryption applies when the header is present but no encryption type is specified. Option B is incorrect because bucket ACLs cannot enforce encryption; they only grant permissions at the bucket or object level. Option C is incorrect because bucket ACLs alone cannot enforce encryption across all uploads. Option D is incorrect because a KMS key policy controls who can use the key, not whether encryption is applied during uploads.
Variation 2. A company has an S3 bucket that stores sensitive customer data. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS. Additionally, they want to enforce that objects are not uploaded without encryption. Which bucket policy should be used?
medium- A.Deny s3:PutObject if the request includes x-amz-server-side-encryption
- ✓ B.Deny s3:PutObject unless the request includes x-amz-server-side-encryption with value aws:kms
- C.Allow s3:PutObject only if the request uses a specific KMS key
- D.Deny s3:PutObject unless the request includes x-amz-server-side-encryption with value AES256
Why B: It uses a Deny effect with a condition that checks for the presence and value of the `x-amz-server-side-encryption` header. This policy explicitly denies any `s3:PutObject` request that does NOT include `x-amz-server-side-encryption` with the value `aws:kms`, thereby enforcing server-side encryption with AWS KMS (SSE-KMS) on all uploads.
Variation 3. A company requires that all data in an S3 bucket be encrypted at rest. The security team wants to enforce that only objects encrypted with AWS KMS are allowed. Which S3 bucket policy condition key should be used to deny PutObject requests if the object is not encrypted with KMS?
medium- A.s3:x-amz-server-side-encryption-key-id
- B.s3:x-amz-server-side-encryption
- C.s3:x-amz-server-side-encryption-kms-key-id
- ✓ D.s3:x-amz-server-side-encryption-aws-kms-key-id
Why D: The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key specifically checks for the AWS KMS key ID (or alias) used for server-side encryption with AWS KMS (SSE-KMS). By using this key in a bucket policy with a `Deny` effect, you can enforce that only objects encrypted with a specific KMS key are allowed, rejecting any `PutObject` request that does not include the required `x-amz-server-side-encryption-aws-kms-key-id` header.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.