Enforcing S3 Bucket Encryption Across AWS Organizations — SCP and AWS Config | AWS Advanced Networking Specialty Explained

• A.Configure AWS Config rules to mark non-compliant buckets and trigger a Lambda function to add encryption.
• B.Create an IAM role in each account that requires encryption for any S3 operation.
• C.Use an S3 bucket policy on every existing and future bucket to deny unencrypted uploads.
• ✓ D.Attach a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.

Why D: A service control policy (SCP) attached to the root OU can deny the s3:CreateBucket action unless the bucket is configured with default encryption, thereby enforcing encryption at rest across all accounts in the organization. Option D is correct. Option A is incorrect because AWS Config rules can detect non-compliance but cannot enforce policies in real time; they are detective, not preventive. Option B is incorrect because IAM roles are account-specific and cannot enforce encryption across all accounts centrally. Option C is incorrect because S3 bucket policies apply only to individual buckets and cannot be applied to future buckets or across accounts without manual configuration.

• A.Create an IAM policy that allows s3:PutBucketEncryption only with specific conditions
• B.Attach an IAM policy to each S3 bucket requiring encryption
• ✓ C.Deny s3:PutBucketEncryption unless encryption settings include AES256 or aws:kms
• D.Use AWS Config rules to auto-enable encryption on existing buckets

Why C: Option C is correct because a Service Control Policy (SCP) applied to the root OU can deny the s3:PutBucketEncryption action unless specific encryption settings (AES256 or aws:kms) are used. This prevents any account in the organization from creating or modifying S3 buckets without encryption. Option A is wrong because IAM policies are attached to principals (users/roles), not to OUs, and cannot enforce encryption across all accounts. Option B is wrong because SCPs are applied to OUs or accounts, not to individual resources like S3 buckets. Option D is wrong because AWS Config rules can detect non-compliance but do not enforce via SCPs; they would require an automated remediation action.

• A.Assign an IAM policy to all users that requires SSE-S3.
• B.Configure a bucket policy on each bucket to deny writes without SSE-S3.
• ✓ C.Create a service control policy (SCP) that denies PutBucketEncryption if the encryption is not SSE-S3.
• D.Use AWS CloudTrail to monitor and alert on non-compliant bucket creations.

Why C: The correct answer is C because a service control policy (SCP) in AWS Organizations can deny PutBucketEncryption unless SSE-S3 is specified, enforcing encryption across all accounts. Option A is wrong because IAM policies are account-level and cannot enforce across all accounts in an organization. Option B is wrong because bucket policies are per-bucket and would require manual configuration on each bucket. Option D is wrong because CloudTrail is a logging service that does not enforce compliance; it only provides monitoring after the fact.

• A.Configure each S3 bucket with a bucket policy that denies access if encryption is not used.
• ✓ B.Apply a service control policy (SCP) at the root level that denies S3 bucket creation unless encryption is configured.
• C.Use AWS Config rules to detect unencrypted S3 buckets and automatically remediate them.
• D.Create an IAM policy that denies creating S3 buckets without encryption and attach it to all users.

Why B: Option B is correct because a service control policy (SCP) can be applied to the root organizational unit in AWS Organizations to centrally deny creating or modifying S3 buckets without KMS encryption across all accounts. Option A is incorrect because bucket policies are per-bucket and cannot enforce encryption at the organizational level. Option C is incorrect because AWS Config rules detect non-compliance after the fact but do not prevent creation; they require additional remediation. Option D is incorrect because IAM policies are account-specific and cannot be enforced across the entire organization.