Enforce Server-Side Encryption with KMS on S3 Uploads
A company wants to restrict access to an S3 bucket so that only objects with server-side encryption using AWS KMS (SSE-KMS) can be uploaded. Which bucket policy condition should be used?
Quick Answer
The answer is the `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key. This is correct because it allows you to enforce server-side encryption with KMS on S3 uploads by requiring a specific KMS key ID, ensuring that only objects encrypted with that key are permitted. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this tests your ability to apply fine-grained S3 bucket policies for encryption compliance, often appearing in scenarios where you must restrict uploads to meet security or regulatory requirements. A common trap is confusing this with `s3:x-amz-server-side-encryption`, which only checks for the presence of encryption (AES256 or aws:kms) but not a specific key, or with KMS-level conditions like `kms:ViaService` that operate outside S3. Memory tip: think "KMS Key ID" as the full, specific condition—if you see "encryption" alone, it’s too broad; always look for the "key-id" suffix to enforce a particular key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:x-amz-server-side-encryption-aws-kms-key-id
S3:x-amz-server-side-encryption-aws-kms-key-id. This condition key in an S3 bucket policy allows you to enforce that objects must be encrypted with a specific AWS KMS key when the SSE-KMS header is used. Option A (kms:ViaService) is a condition key used in KMS key policies, not in S3 bucket policies; it controls which AWS services can use the KMS key. Option B (s3:x-amz-server-side-encryption) checks the encryption header but cannot enforce a specific KMS key ID—it only checks for the value 'aws:kms' or 'AES256', but not the key ID. Option C (aws:SourceVpce) is used to restrict access to a specific VPC endpoint, not encryption settings. Therefore, only D provides the granularity to require a specific KMS key ID for SSE-KMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kms:ViaService
Why it's wrong here
This is a KMS condition, not applicable to S3 bucket policy.
- ✗
s3:x-amz-server-side-encryption
Why it's wrong here
This condition checks for encryption but not the specific KMS key.
- ✗
aws:SourceVpce
Why it's wrong here
This restricts VPC endpoint, not encryption.
- ✓
s3:x-amz-server-side-encryption-aws-kms-key-id
Why this is correct
This condition enforces a specific KMS key ID for SSE-KMS.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to restrict access to its S3 bucket so that only objects uploaded with server-side encryption using AWS KMS (SSE-KMS) are allowed. Which bucket policy condition should be used?
medium- ✓ A.s3:x-amz-server-side-encryption-aws-kms-key-id
- B.s3:x-amz-server-side-encryption
- C.kms:ViaService
- D.kms:EncryptionContext
Why A: The s3:x-amz-server-side-encryption-aws-kms-key-id condition key allows you to require that objects uploaded to the bucket are encrypted with a specific KMS key, thus enforcing SSE-KMS. Option B (s3:x-amz-server-side-encryption) only checks for any server-side encryption, not a specific key. Option C (kms:ViaService) is a condition key for KMS key policies, not S3 bucket policies. Option D (kms:EncryptionContext) is used in KMS policies to restrict encryption contexts, not applicable to S3 bucket policies.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.