How to Enforce SSE-S3 Encryption and Deny SSE-KMS on S3

Correct answer & explanation

Option C is correct because updating the bucket policy to explicitly deny uploads with SSE-KMS ensures that only SSE-S3 encryption is allowed. The current policy denies uploads without the x-amz-server-side-encryption header set to AES256, but it does not prevent uploads that specify SSE-KMS (which uses a different header value). By adding a deny condition for SSE-KMS, the company can enforce SSE-S3 exclusively. Option A is incorrect because S3 Lifecycle policies manage object transitions and expiration, not encryption enforcement. They cannot change encryption of existing objects or prevent new uploads with unauthorized encryption. Option B is incorrect because enabling default encryption on the bucket applies only to objects uploaded without explicit encryption headers. It does not block uploads that specify SSE-KMS or other encryption methods, as the request headers override default encryption. Option D is incorrect because S3 Object Lambda is designed to transform data when objects are retrieved, not to enforce encryption settings on new uploads. It cannot change the encryption of objects at rest.

Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.