SAA-C03 Design Secure Architectures Practice Question

A security team stores sensitive documents in an Amazon S3 bucket that is encrypted with SSE-KMS using a customer managed key. An auditor requires that every object upload be traceable to the IAM principal that performed it and that the key's usage be independently auditable. The team also wants to prevent any principal, including account administrators, from reading objects without a corresponding key grant. Which configuration combination meets these requirements?

⚠ Common exam trap

The trap here is believing that S3 server access logging or CloudTrail management events alone can attribute object uploads and prove key usage, when object-level activity requires data events and key usage requires KMS management events.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable AWS CloudTrail data events for the S3 bucket, enable CloudTrail management events for KMS, and ensure the key policy delegates usage only to explicitly named roles.

Object-level traceability requires CloudTrail data events on the bucket, and independent key auditing requires CloudTrail management events on KMS so that Encrypt and Decrypt calls appear in the log. Limiting the key policy to named roles creates a second authorization boundary, so possession of S3 permissions alone is insufficient to read the encrypted objects.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enable AWS CloudTrail data events for the S3 bucket, enable KMS key rotation, and apply a bucket policy that requires the aws:SecureTransport condition.
Why it's wrong here
CloudTrail data events do satisfy the upload traceability requirement, but automatic key rotation changes the backing key material without producing a record of who used the key. The aws:SecureTransport condition only enforces TLS in transit and does nothing to prevent an administrator who lacks a key grant from being granted decryption through an overly permissive key policy.
✗
Enable S3 server access logging to a separate bucket, enable S3 default encryption with SSE-S3, and attach a bucket policy that denies unencrypted uploads.
Why it's wrong here
Server access logs are delivered on a best-effort basis and do not capture KMS API calls, so key usage cannot be audited from them. Switching to SSE-S3 removes the customer managed key entirely, which eliminates the ability to grant or withhold decryption independently of the bucket policy, so administrators with bucket access could read the objects.
✓
Enable AWS CloudTrail data events for the S3 bucket, enable CloudTrail management events for KMS, and ensure the key policy delegates usage only to explicitly named roles.
Why this is correct
S3 data events record the identity of the caller for object-level operations such as PutObject and GetObject, while KMS management events capture Encrypt, Decrypt, and key policy changes. Restricting the key policy to named roles means an administrator without an explicit key grant cannot decrypt the data even if the bucket policy allows the S3 action, providing independent control over the key.
✗
Enable S3 Object Lock in compliance mode, enable CloudTrail management events for S3, and use a key policy that grants kms:Decrypt to the account root user.
Why it's wrong here
Object Lock prevents deletion or overwrite for a retention period but does not record which principal uploaded an object or who used the key. CloudTrail management events do not capture object-level S3 activity, and granting Decrypt to the account root effectively gives every administrator with root or delegated access the ability to read the data, defeating the separation requirement.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAA-C03 Design Secure Architectures Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question