SAP-C02 Practice Question: Design Solutions for Organizational Complexity

A company is deploying a multi-account AWS environment using AWS Organizations. The security team requires that all Amazon S3 buckets in member accounts are encrypted with AWS KMS customer managed keys, and that the keys are created and managed centrally in a security account. Which solution should a solutions architect recommend?

⚠ Common exam trap

Many candidates confuse SSE-S3 with SSE-KMS, or assuming that default encryption alone enforces the use of a specific customer managed key.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create KMS keys in the security account and grant member accounts permission to use them via key policies and IAM policies. Use an S3 bucket policy in each member account to enforce encryption with the central key.

Creating KMS keys in a central security account and sharing them with member accounts via key policies and IAM policies keeps key management centralized. Enforcing encryption with those keys through S3 bucket policies in each member account ensures all buckets use the approved keys, meeting both the central management and encryption requirements.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create KMS keys in each member account and use AWS CloudFormation StackSets to deploy bucket policies that enforce their use.
Why it's wrong here
Creating keys in each member account decentralizes key management, which contradicts the requirement for central management. It also increases the number of keys to manage and rotate, and does not provide the security team with centralized control over key policies.
✗
Use AWS Secrets Manager to store KMS key material centrally and grant member accounts access to the secret.
Why it's wrong here
AWS Secrets Manager is for storing secrets, not for managing KMS keys or enforcing S3 encryption. It cannot be used as a KMS key, and granting access to a secret does not provide encryption capabilities or enforce bucket policies.
✗
Enable default encryption on all S3 buckets using SSE-S3 and use AWS Config to monitor compliance.
Why it's wrong here
SSE-S3 uses Amazon S3 managed keys, not AWS KMS customer managed keys, and does not meet the requirement for central KMS key management. AWS Config provides detection, not enforcement, and cannot enforce the use of a specific KMS key.
✓
Create KMS keys in the security account and grant member accounts permission to use them via key policies and IAM policies. Use an S3 bucket policy in each member account to enforce encryption with the central key.
Why this is correct
Centralizing KMS keys in the security account with cross-account key policies allows member accounts to use the keys for S3 encryption while keeping key management centralized. S3 bucket policies in member accounts can enforce that all PUT requests use the specified KMS key, satisfying the encryption requirement.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question