A security team requires that every object uploaded to s3://secure-bucket/uploads/ must be encrypted using SSE-KMS with a specific customer-managed KMS key. Which S3 bucket policy condition approach best enforces this requirement for PutObject requests?

Allow PutObject only when aws:SecureTransport is true; encryption is then guaranteed automatically

aws:SecureTransport only controls that the request uses HTTPS (TLS in transit). It does not ensure server-side encryption at rest in S3 or that SSE-KMS with the mandated CMK is used.

Deny PutObject if the request includes Content-Type other than "application/octet-stream"

Content-Type is an application/content metadata header and has no direct relationship to whether S3 encrypts the object with SSE-KMS or which KMS key is used.

Deny PutObject when the caller’s role is not allowed to kms:Decrypt in their IAM policy

kms:Decrypt permissions relate to decrypting objects later (for example, after retrieval or during operations that require decryption). They do not control whether S3 accepts the PutObject request using the required SSE-KMS configuration and CMK at upload time.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Deny PutObject unless s3:x-amz-server-side-encryption equals "aws:kms" and s3:x-amz-server-side-encryption-aws-kms-key-id equals the required CMK ARN — To enforce that uploads use SSE-KMS with a specific customer-managed KMS key, use a bucket policy that denies PutObject unless the client’s request headers indicate (1) server-side encryption type is aws:kms and (2) the specified KMS key ID/ARN matches the required CMK. This checks SSE configuration during the upload request, preventing both unencrypted uploads and uploads encrypted with a different KMS key. Why others are wrong: aws:SecureTransport ensures TLS in transit, not encryption at rest. Content-Type does not affect SSE settings. Checking kms:Decrypt permission is about authorization for decryption operations later and does not enforce the SSE-KMS headers used during PutObject.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.