SAA-C03 Design Secure Architectures Practice Question
You must ensure that all requests to an S3 bucket use TLS (HTTPS). Which S3 bucket policy approach best enforces this requirement for S3 access?
⚠ Common exam trap
Candidates often confuse encryption in transit (TLS/HTTPS) with encryption at rest (SSE-KMS or SSE-S3), leading them to select Option D, which does not address the transport security requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a policy statement that explicitly Denies any action when aws:SecureTransport is false
The `aws:SecureTransport` condition key evaluates whether the request was sent using TLS. By explicitly denying all S3 actions when `aws:SecureTransport` is false, any HTTP request is rejected, ensuring only HTTPS requests succeed. This approach uses an explicit deny, which overrides any allow, making it the most secure and reliable method to enforce TLS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow all principals to GetObject when aws:SecureTransport is true
Why it's wrong here
An Allow statement restricted to aws:SecureTransport being true does not actually stop non-TLS requests, because S3 access policy evaluation combines all applicable Allow statements. If any other bucket policy, ACL, or IAM identity-based policy grants the same action without the transport condition, an HTTP request can still be allowed. Only an explicit Deny for aws:SecureTransport equal to false can block insecure traffic, since an explicit deny always overrides an allow.
- ✓
Use a policy statement that explicitly Denies any action when aws:SecureTransport is false
Why this is correct
A bucket policy statement with Effect = Deny and a condition aws:SecureTransport = false blocks non-HTTPS requests. Because explicit Deny overrides Allow during policy evaluation, this prevents access for any request that does not use TLS, even if other statements grant permissions.
- ✗
Deny requests only when the bucket name is not matched exactly in the request
Why it's wrong here
Matching the bucket name in a condition checks the request's resource target, not whether the connection was encrypted. A client can craft a non-TLS request that includes the exact, correct bucket name in the path and Host header, so denying on bucket-name mismatch would do nothing to reject the insecure request. The condition key that actually evaluates transport security is aws:SecureTransport, so using the wrong condition fails to address the TLS requirement altogether.
- ✗
Require that the requester uses SSE-KMS and reject requests without SSE-KMS configuration
Why it's wrong here
SSE-KMS encrypts the object's data at rest in S3 using a KMS-managed key, but it has no effect on how data travels between the client and S3 over the network. A request sent over plain HTTP can still be validly signed and include SSE-KMS headers, meaning the object is encrypted at rest while the in-transit contents are exposed. Therefore, requiring SSE-KMS cannot guarantee TLS and may merely block legitimate non-SSE-KMS requests without achieving the transport security goal.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAA-C03 question is part of Courseiva's 935-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.