IAM Policy Condition Requiring SSE-S3 Encryption Header for S3 PutObject

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}
```

Refer to the exhibit. An IAM policy is attached to a user. When the user tries to upload an object to the S3 bucket 'my-bucket' using the AWS CLI without specifying server-side encryption, the upload fails. What is the MOST likely reason?

Quick Answer

The answer is that the upload fails because the IAM policy condition requires the SSE-S3 encryption header for S3 PutObject, and the request did not include it. Specifically, the policy enforces the `s3:x-amz-server-side-encryption` header to be set to `AES256`, so when the user omits the encryption header, the condition evaluates to false and the request is denied, even though the user has the `s3:PutObject` action allowed. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your understanding of how IAM policy conditions can enforce encryption at the request level, a common trap where candidates assume the bucket policy is the culprit or that the user lacks permissions entirely. The key insight is that a condition key like `s3:x-amz-server-side-encryption` acts as a gate: the action is permitted only if the header matches the required value. A useful memory tip is "no header, no entry"—if the encryption header is missing, the condition fails, blocking the upload.

⚠ Common exam trap

Many candidates assume the failure is due to missing `s3:PutObject` permission (Option D) or a blanket bucket policy (Option A), but the real issue is the conditional `Deny` that enforces encryption headers, which is a subtle but critical distinction in IAM policy evaluation logic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy requires server-side encryption with AES256, but the request did not include the encryption header.

The IAM policy explicitly requires the `s3:x-amz-server-side-encryption` condition with a value of `AES256`. When the user uploads an object via the AWS CLI without specifying the `--server-side-encryption AES256` flag, the request lacks the required encryption header, causing the condition in the policy to fail and the upload to be denied. The policy does not deny all uploads without encryption—it only denies those that fail to meet the specific encryption requirement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The bucket policy denies all uploads without encryption.
Why it's wrong here
The exhibit shows user policy, not bucket policy.
✓
The policy requires server-side encryption with AES256, but the request did not include the encryption header.
Why this is correct
The condition enforces encryption.
✗
The user is not the bucket owner.
Why it's wrong here
Not relevant to the policy.
✗
The user does not have permission to call s3:PutObject.
Why it's wrong here
The policy allows s3:PutObject.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

2 more ways this is tested on SAP-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company has an IAM policy attached to a user. The user is trying to download an object from the S3 bucket 'my-bucket' that was uploaded with SSE-S3 encryption. What will happen?

medium

A.The user will be allowed only if the object was uploaded with SSE-KMS.
B.The user will be denied access because the condition is not met.
✓ C.The user will be allowed to download the object.
D.The user will be denied because SSE-S3 is not AES256.

Why C: SSE-S3 uses AES-256 encryption managed by Amazon S3, and the encryption/decryption process is transparent to the user. When a user has the s3:GetObject permission in their IAM policy, they can download the object regardless of SSE-S3 encryption, as S3 automatically decrypts the object upon retrieval. The IAM policy does not require any additional conditions for SSE-S3, so the user is allowed to download the object.

Variation 2. A company has an S3 bucket with server-side encryption using S3-Managed Keys (SSE-S3). The IAM policy shown in the exhibit is attached to a user. When the user attempts to download an object using the AWS CLI with no encryption headers, the request fails. What is the MOST likely reason?

medium

A.The object is encrypted with SSE-KMS, not SSE-S3.
B.The user does not have the s3:GetObject permission.
C.The bucket has a bucket policy that denies all requests.
✓ D.The policy condition requires the encryption header in the request.

Why D: The IAM policy attached to the user includes a condition that requires the presence of the x-amz-server-side-encryption header in the request, and the header value must match either aws:kms or AES256. When the user issues a download request (GetObject) via the AWS CLI without specifying any encryption header, the condition is not satisfied, and the request is denied. This is a security measure to enforce encryption in transit or to ensure that the client is aware of the encryption, even though the object is encrypted with SSE-S3. Note that for SSE-S3 objects, the x-amz-server-side-encryption header is not required on GET requests by default, but the IAM policy can still require it, causing failure if omitted.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.