SAA-C03 Design Secure Architectures Practice Question

A company is designing a secure architecture for a new application on AWS. The application will store sensitive data in Amazon S3 and will be accessed by users from a web browser. The security team requires that data be encrypted in transit and at rest, and that access to the S3 bucket be limited to only the application's users. The company also wants to minimize operational overhead. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

⚠ Common exam trap

The trap here is focusing on encryption at rest and auditing while overlooking that encryption in transit and user-scoped access require separate controls.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure the S3 bucket policy to deny requests that do not use TLS (aws:SecureTransport condition).

To encrypt data in transit, a bucket policy that denies non-TLS requests enforces HTTPS. To limit access to application users, Cognito user pools authenticate users and identity pools issue temporary credentials with an IAM role scoped to the bucket. Together, these provide secure access with minimal operational overhead. The other options either do not address both requirements or increase management burden.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create an IAM user for each application user and attach a policy that allows access to the S3 bucket.
Why it's wrong here
Creating individual IAM users for each application user increases operational overhead and does not scale well. It also requires managing long-term credentials, which is less secure than temporary credentials. This does not meet the requirement to minimize operational overhead.
✗
Configure the S3 bucket to use server access logging and enable AWS CloudTrail data events for the bucket.
Why it's wrong here
Server access logging and CloudTrail data events provide auditing and visibility, but they do not encrypt data or restrict access. They are detective controls, not preventive controls. While useful for compliance, they do not satisfy the encryption in transit or access limitation requirements.
✓
Configure the S3 bucket policy to deny requests that do not use TLS (aws:SecureTransport condition).
Why this is correct
Enforcing aws:SecureTransport in the bucket policy denies any request made over HTTP, ensuring data is encrypted in transit. This is a low-overhead, declarative way to meet the encryption in transit requirement without modifying application code. It applies to all requests to the bucket, including those from the application and any other principals.
✓
Use Amazon Cognito user pools to authenticate users and grant temporary AWS credentials via an identity pool with an IAM role that has access to the S3 bucket.
Why this is correct
Cognito user pools handle user authentication, and identity pools can issue temporary AWS credentials scoped to an IAM role. That role can be granted least-privilege access to the specific S3 bucket. This limits access to authenticated application users and minimizes operational overhead by using managed services.
✗
Enable S3 default encryption with SSE-S3 and enable versioning on the bucket.
Why it's wrong here
SSE-S3 provides encryption at rest, but versioning does not contribute to encryption in transit or access control. While default encryption is useful, the requirement for limiting access to only the application's users is not addressed by versioning. This option does not meet both requirements.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAA-C03 Design Secure Architectures Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question