Enforce S3 Bucket Encryption and Public Access Controls Across AWS Organizations

• A.Use AWS Config rules with auto-remediation using SSM Automation.
• B.Use an AWS Lambda function triggered by S3 bucket creation events to enable encryption.
• C.Enable AWS CloudTrail and create a metric filter to alert on non-encrypted bucket creation.
• ✓ D.Apply a service control policy (SCP) that denies s3:PutBucketEncryption actions unless encryption is set.

Why D: Option D is correct because a service control policy (SCP) can proactively deny the creation of S3 buckets without encryption, enforcing compliance across all accounts before any non-compliant bucket is created. Option A is incorrect because AWS Config rules with SSM Automation remediate after the fact, introducing a delay and relying on detection, not prevention. Option B is incorrect because an AWS Lambda function triggered by S3 bucket creation events reacts to the creation event but does not prevent the bucket from being created unencrypted; it only attempts to enable encryption after creation, which may not always work seamlessly. Option C is incorrect because CloudTrail and metric filters only provide alerts after the non-compliant bucket is created, offering no automated remediation or prevention.

• A.Configure AWS CloudFormation StackSets to deploy a bucket creation template with encryption.
• ✓ B.Apply a service control policy (SCP) that denies PutBucketEncryption with no encryption.
• C.Create an AWS Config rule in each account to remediate non-compliant buckets.
• D.Use AWS CloudTrail to detect bucket creation and trigger a Lambda function to enable encryption.

Why B: Using an SCP in AWS Organizations to deny creation of buckets without encryption is the most scalable solution, as it applies to all accounts in the organization. Option B is correct. Option A is per-account. Option C is reactive. Option D is not scalable across accounts.

• A.Apply an S3 bucket policy on each bucket that denies PutObject without encryption.
• ✓ B.Create an SCP that denies PutBucketAcl or PutBucketPolicy actions if the bucket does not have encryption enabled.
• C.Use AWS CloudTrail to monitor S3 API calls and alert on unencrypted bucket creation.
• ✓ D.Enable AWS Config managed rule s3-bucket-server-side-encryption-enabled to detect non-compliant buckets.
• ✓ E.Enable default encryption on all S3 buckets using the AWS S3 console or API.

Why B: Option B is correct because a service control policy (SCP) can deny PutBucketAcl or PutBucketPolicy actions if the bucket does not have encryption enabled, preventing disabling of encryption at the bucket level. Option D is correct because AWS Config managed rule s3-bucket-server-side-encryption-enabled can detect S3 buckets that lack server-side encryption. Option E is correct because enabling default encryption on all S3 buckets ensures that new objects are automatically encrypted. Option A is incorrect because while an S3 bucket policy can enforce encryption on uploads, it does not enforce encryption on existing objects and must be applied per bucket; moreover, it is not an organization-wide enforcement mechanism. Option C is incorrect because AWS CloudTrail only logs API calls and does not enforce encryption; it can alert but does not remediate.

• A.AWS Resource Access Manager
• B.AWS WAF
• C.AWS IAM Identity Center (SSO)
• ✓ D.AWS Config
• ✓ E.AWS Organizations Service Control Policies (SCPs)

Why D: AWS Organizations Service Control Policies (SCPs) can deny public access to S3 buckets at the organization or OU level, providing preventive control. AWS Config can be used to detect publicly accessible S3 buckets and trigger remediation (e.g., via auto-remediation or Lambda). Option A is incorrect because AWS Resource Access Manager is for sharing resources, not enforcing security policies. Option B is incorrect because AWS WAF is a web application firewall, not for S3 bucket access control. Option C is incorrect because AWS IAM Identity Center (SSO) manages user identities and access, not bucket policies.

• ✓ A.Create an SCP that denies s3:CreateBucket unless encryption is specified.
• B.Use CloudTrail to monitor bucket creation and alert security team.
• C.Create an SCP that denies s3:PutBucketPublicAccessBlock without encryption.
• D.Use AWS Config rules to detect non-compliant buckets and auto-remediate.

Why A: Option A is correct because a service control policy (SCP) can deny creation of S3 buckets without encryption. Options B, C, and D are not effective at enforcing across all accounts.

• ✓ A.Use AWS Config rules to automatically remediate non-compliant buckets.
• B.Enable AWS CloudTrail to monitor and automatically remediate non-compliant buckets.
• ✓ C.Create an SCP to deny s3:PutObject actions without the x-amz-server-side-encryption header set to aws:kms.
• D.Create an S3 bucket policy in each account to enforce encryption and block public access.
• E.Create an SCP to deny s3:PutBucketPublicAccessBlock and s3:PutBucketPolicy actions unless encryption is enabled.

Why A: Option A uses AWS Config rules with automatic remediation to enforce compliance on both encryption and public access settings. Option C creates an SCP that denies s3:PutObject actions unless the x-amz-server-side-encryption header is set to aws:kms, ensuring new objects are encrypted with KMS. Option E is incorrect because it only denies put actions on bucket policies and public access blocks if encryption is not enabled, but does not itself prohibit public access; users could still enable public access if encryption is met. Option B is incorrect because CloudTrail is for auditing, not remediation. Option D is incorrect because per-account bucket policies can be overridden and are less effective than organizational policies.

• ✓ A.Create an AWS Config rule that checks for S3 bucket default encryption and auto-remediates using SSM Automation.
• ✓ B.Create a service control policy (SCP) that denies s3:PutObject unless the x-amz-server-side-encryption header is present.
• C.Use Amazon GuardDuty to monitor S3 data access patterns.
• D.Create an IAM role with permissions to encrypt S3 buckets and assign it to all users.
• E.Enable AWS CloudTrail to log all S3 API calls.

Why A: Option A is correct because AWS Config can be configured with a managed rule (e.g., s3-bucket-server-side-encryption-enabled) to detect buckets without default encryption, and an automatic remediation action using AWS Systems Manager (SSM) Automation can enforce encryption by applying the bucket's default encryption settings. Option B is correct because a service control policy (SCP) that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to S3 must include encryption headers, effectively enforcing encryption at the API level across all accounts in the organization.