Data Protection practice questions

Configure an S3 Lifecycle policy to encrypt all objects with the KMS key after upload.

Why wrong: Lifecycle policies are designed for transitions between storage classes or object expiration, not for enforcing encryption at the moment of ingestion. Relying on a lifecycle rule creates a window of vulnerability where data exists in an unencrypted or incorrectly encrypted state before the rule triggers.

Attach a bucket policy that denies s3:PutObject if the x-amz-server-side-encryption-aws-kms-key-id header is missing or incorrect.

Why wrong: The bucket policy acts as a gatekeeper during the put operation. By explicitly checking for the KMS header, the policy ensures every object written to the bucket is protected by the specified key, effectively blocking any request that attempts to bypass this requirement or use different encryption settings.

Enable S3 Object Lock in compliance mode for all new objects in the bucket.

Why wrong: S3 Object Lock is a WORM (Write Once, Read Many) feature intended to prevent data deletion or modification, not to enforce encryption. It provides data integrity and retention, but it does not mandate the use of a specific KMS key or any encryption method for the stored objects.

The resource in the IAM policy must be the specific ARN of the KMS key.

Why wrong: While using the specific key ARN is a security best practice, using a wildcard for the resource does not cause an access denied error. The issue here is the interaction between the IAM policy and the KMS key policy, which is the primary gatekeeper for key usage.

The KMS key is in a different AWS region than the S3 bucket.

Why wrong: KMS keys are regional, but you can decrypt data from an S3 bucket in one region using a key in the same region. If the application is configured to call the regional endpoint correctly, the region itself is not the primary cause of a standard access denied error.

The application is missing the 'kms:GenerateDataKey' permission in its policy.

Why wrong: The 'kms:GenerateDataKey' permission is required for encryption operations, not for decryption. Since the application is attempting to decrypt S3 objects, the 'kms:Decrypt' permission is sufficient for the operation, provided the key policy also allows it for the identity attempting the action.

Attach an IAM policy that allows 'secretsmanager:GetSecretValue' to all users.

Why wrong: Granting 'secretsmanager:GetSecretValue' to all users violates the principle of least privilege, exposing sensitive credentials to unauthorized entities. Access to secrets should be strictly scoped to the specific applications or services that require them, ensuring that the blast radius of any potential credential compromise is minimized.

Store the secret value in plain text within the application's configuration file.

Why wrong: Storing secrets in plain text files is a major security vulnerability, as these files can be easily accessed or committed to source control. Secrets Manager is designed specifically to prevent this by programmatically retrieving credentials at runtime, removing the need for hardcoded or file-based secrets.

AWS Trusted Advisor

Why wrong: Trusted Advisor provides periodic checks and best practice recommendations, including S3 public access checks. However, it is not a proactive, real-time monitoring tool like AWS Config, which can trigger automated remediation actions via AWS Systems Manager or Lambda when a non-compliant configuration is detected.

AWS Config

Why wrong: AWS Config provides continuous monitoring of resource configurations. By enabling rules that check for S3 public access, you can identify and potentially auto-remediate buckets that become public. This provides a robust detective control that is essential for maintaining compliance and preventing accidental data exposure.

AWS CloudTrail

Why wrong: CloudTrail records API activity for audit purposes. While it logs the 'PutBucketPolicy' actions that could make a bucket public, it does not inherently monitor or evaluate the 'state' of the bucket's accessibility. You would need additional tools to analyze logs to detect the current exposure.

The KMS key ARN is incorrect for the region.

Why wrong: The key ARN format is standard. Unless the account ID or key ID is specifically wrong, the ARN itself is not the source of the denial. The condition block is a more restrictive and likely culprit for access issues than the resource definition itself in this specific policy.

The policy is missing the 'kms:GenerateDataKey' permission.

Why wrong: While 'kms:GenerateDataKey' is needed for encryption, the error is occurring during decryption. The policy explicitly allows 'kms:Decrypt', so the absence of other permissions is not the primary cause of the current failure. The IP condition is the most restrictive element present in the provided policy statement.

The 'Effect' should be 'Deny' instead of 'Allow'.

Why wrong: Changing the effect to 'Deny' would explicitly block access to the key, which would make the situation worse. The 'Allow' effect is necessary to grant permission to the identity. The issue is clearly related to the constraints within the condition block, not the effect of the policy.

Enable encryption using the default AWS-managed key for Aurora.

Why wrong: AWS-managed keys are automatically managed by AWS and do not provide the level of control required by the user. You cannot modify the key policy or change the rotation schedule of an AWS-managed key, making it unsuitable for requirements that necessitate strict administrative control over the key.

Use AWS CloudHSM to manage the encryption keys for the Aurora database.

Why wrong: While CloudHSM provides high levels of control, it is not a native option for RDS/Aurora at-rest encryption. Integration with RDS requires AWS KMS. Attempting to use CloudHSM for this purpose would be architecturally impossible, as RDS requires the KMS service interface for volume encryption operations.

Enable TDE (Transparent Data Encryption) in the Aurora parameter group.

Why wrong: Aurora does not use TDE for at-rest storage encryption. It utilizes KMS-based volume encryption. Suggesting TDE shows a lack of understanding of Aurora's architecture, which relies on the storage volume being encrypted at the block level through the AWS infrastructure, rather than through application-level database parameters.

Store data in an S3 bucket with 'Block Public Access' enabled.

Why wrong: While 'Block Public Access' is a critical security feature for S3, it is a data-at-rest protection control, not a data-in-transit protection method. It prevents unauthorized access to the bucket but does not govern the security of the communication protocol used to transmit the data.

Enable S3 Object Lock to prevent object deletion.

Why wrong: S3 Object Lock is a WORM feature that protects data integrity by preventing deletion or modification. It has no role in the protection of data in transit. Confusing this with transit security demonstrates a fundamental misunderstanding of the different layers of data protection in AWS.

It allows only 'ListBucket' actions for all users.

Why wrong: While it does allow 'ListBucket', the policy also contains a 'Deny' statement that affects all S3 actions, not just listing. The statement is not limited to just one action; it applies to all actions if the secure transport condition is not met.

It forces all users to authenticate using MFA to access the bucket.

Why wrong: The policy contains no condition related to MFA. It focuses entirely on transport security (HTTPS/SSL). Confusing transport security with authentication factors like MFA shows a lack of understanding of the specific policy keys available in AWS IAM and S3 bucket policies.

It prevents users from downloading objects unless they have a specific key.

Why wrong: There is no condition in the policy that checks for a specific key or decryption permission. The policy is strictly focused on network-level security (transport layer). Access control and encryption keys are handled by different sets of policies and configurations, not by this specific transport-level policy.

Create a new CMK every year and update the application configuration to use the new Key ARN.

Why wrong: Creating a new CMK manually increases operational complexity significantly. Every time a new key is generated, the security team must update all application configurations, IAM policies, and resource-based policies. This approach also makes it harder to manage historical data, as applications must keep track of multiple ARNs for different objects.

Schedule a Lambda function to perform manual rotation by updating the key alias every 90 days.

Why wrong: While a Lambda function can automate the creation of new keys and update aliases, it introduces unnecessary custom code and maintenance. Using aliases helps decouple applications from specific ARNs, but it does not provide the same seamless background decryption for older versions that the native KMS automatic rotation feature offers.

Enable automatic rotation and configure the key to delete old key material after 365 days.

Why wrong: AWS KMS never deletes old key material during an automatic rotation process. If the old backing material were deleted, any data previously encrypted with that material would become permanently unrecoverable. KMS intentionally retains all historical versions of the key material specifically to support the decryption of legacy data at any time.

It forces all users to use MFA-protected API calls when accessing the bucket.

Why wrong: This policy does not reference Multi-Factor Authentication. To enforce MFA, the policy would need to use the 'aws:MultiFactorAuthPresent' condition key. The current policy is strictly focused on the transport layer security of the connection, ensuring that data is encrypted while being transmitted over the network via HTTPS.

It ensures all data stored in the bucket is encrypted using SSE-S3.

Why wrong: This policy controls encryption in transit, not encryption at rest. To enforce server-side encryption at rest, the policy would need to inspect headers like 'x-amz-server-side-encryption'. SecureTransport only verifies that the communication channel between the client and the S3 service is encrypted using the SSL/TLS protocol.

It prevents the bucket from being accessed from any IP address outside of the corporate VPC.

Why wrong: This policy does not include any network-based conditions such as 'aws:SourceIp' or 'aws:SourceVpc'. While it restricts the protocol used for communication, it does not restrict the origin of the traffic. Users from any location can still access the bucket as long as they use HTTPS and have appropriate permissions.

It restricts all KMS operations to only be performed by the account's root user.

Why wrong: The 'root' principal in a resource-based policy refers to the account itself, not just the root user credentials. This is a common pattern used to allow the account administrator to manage permissions through IAM roles and users, providing more granular control than restricting access to a single identity.

It automatically grants every IAM user in the account full access to the KMS key.

Why wrong: This policy only enables the *possibility* for IAM users to have access. Each individual user or role must still be granted specific KMS permissions (like kms:Decrypt) via an identity-based IAM policy. It removes the 'key policy' hurdle but does not bypass the need for explicit IAM authorization.

It makes the KMS key public and allows any AWS account to use it for encryption.

Why wrong: The policy specifically names account '111122223333' as the principal. It does not use a wildcard '*' for the principal, which would be required to make the key public. This configuration is highly secure and is the standard way to bridge KMS key policies with IAM identity-based policies.

Use the 'Modify Cluster' command to enable encryption on the live Redshift cluster.

Why wrong: Redshift does not support the 'Modify Cluster' operation for changing an unencrypted cluster to an encrypted one. This is because encryption at rest involves a fundamental change in how data is laid out on the physical disks, necessitating a new cluster creation rather than a simple configuration change in place.

Enable 'Encryption by Default' in the Redshift console to automatically migrate the data.

Why wrong: Unlike EBS, Redshift does not have a global 'Encryption by Default' setting that automatically migrates existing unencrypted clusters. Encryption must be specified at the time of cluster creation or during a restore from a snapshot. There is no automated background migration for existing unencrypted Redshift data assets.

Attach a KMS key policy to the unencrypted cluster to encrypt the data in place.

Why wrong: Attaching a policy to a KMS key does not cause data on an existing unencrypted resource to become encrypted. KMS policies only control who can use the key for cryptographic operations. To encrypt data, the service (Redshift) must actively use the key to rewrite the data in an encrypted format.

S3 Object Lock in Governance mode.

Why wrong: Governance mode is less restrictive than Compliance mode. It allows users with special permissions (the 's3:BypassGovernanceRetention' permission) to delete or modify objects before the retention period expires. This is useful for internal testing but does not meet the requirement of preventing even the root user from deleting data.

S3 Bucket Policies with an explicit Deny for 's3:DeleteObject'.

Why wrong: While a bucket policy with an explicit Deny is strong, it can be modified or deleted by users with administrative permissions or by the root user. Therefore, it does not provide the same guarantee of immutability as Object Lock, which is enforced at the object level by the S3 service itself.

Amazon S3 Glacier with a Vault Lock policy.

Why wrong: Glacier Vault Lock is a valid way to enforce WORM, but the question specifically asks about S3 features for records. While S3 Glacier is a storage class, the S3 Object Lock feature is the modern and more flexible way to manage immutability for objects stored in any S3 storage class, including S3 Standard.

Enable EBS Multi-Region Replication for all volumes needing backup.

Why wrong: EBS does not have a 'Multi-Region Replication' feature for volumes. Data is replicated within an Availability Zone for durability, but cross-region protection must be handled via snapshots or managed services like AWS Backup. This option describes a feature that does not exist in the way implied for backups.

Use S3 Cross-Region Replication (CRR) to move the backup files between regions.

Why wrong: EBS and RDS backups are not stored as files in your S3 buckets that you can directly manage with CRR. They are stored in service-managed S3 buckets or internal storage. AWS Backup is the correct service to orchestrate the movement of these specialized backup types between regions.

Create a single global KMS key to be used across all AWS regions for backup encryption.

Why wrong: AWS KMS keys are region-specific and cannot be 'global'. Even multi-region keys are actually separate key resources in different regions with the same key material. You must manage keys in each region where you store backups, as a single key cannot span across regional boundaries in AWS.

Attach an IAM policy to the Account B role allowing kms:Decrypt on all resources and update the Account A S3 bucket policy to allow public access to the encrypted objects.

Why wrong: Public access to the bucket does not bypass the need for specific KMS permissions, and using a wildcard for all resources in an IAM policy is a security risk. Furthermore, KMS keys do not support public access, so the auditor would still be blocked from decrypting the objects without explicit authorization.

Use an S3 Access Point in Account A to grant access to Account B and enable the 'KMS PassThrough' flag on the Access Point configuration to manage decryption.

Why wrong: AWS S3 Access Points do not have a 'KMS PassThrough' feature for handling cross-account key permissions. Access Points simplify bucket access management but still require the underlying KMS key policy to be correctly configured to allow the external principal to perform cryptographic operations like decryption on the stored data.

Create a cross-account IAM role in Account A that the auditors assume, then grant that role permissions to the S3 bucket only, as S3 handles KMS decryption automatically for assumed roles.

Why wrong: S3 does not automatically handle KMS decryption for assumed roles if the role lacks explicit permissions to use the key. Even if the role is in the same account as the key, the IAM role must have permissions to the KMS key unless the key policy grants root account access.

Automatic key rotation is enabled by default for all Customer Managed Keys at the time of creation to ensure maximum security.

Why wrong: Automatic rotation is not enabled by default for Customer Managed Keys; it must be explicitly enabled by the user. While AWS recommends rotating keys annually, the decision is left to the customer to ensure they have control over their key management lifecycle and any potential costs associated with the rotation.

Enabling automatic rotation for an asymmetric CMK ensures that both the private and public key pairs are updated every 365 days.

Why wrong: AWS KMS does not support automatic rotation for asymmetric keys, HMAC keys, or keys with imported key material. Automatic rotation is strictly limited to symmetric encryption CMKs that use KMS-generated key material. For asymmetric keys, users must manually create new keys and update their applications to use the new pairs.

Once a key is rotated, all existing S3 objects encrypted with the old key material are automatically re-encrypted with the new key material within 24 hours.

Why wrong: KMS rotation does not trigger a re-encryption of existing data. Data remains encrypted with the specific version of the key material used at the time of the encryption operation. Re-encrypting data would be resource-intensive and expensive; instead, KMS simply maintains the old material to allow continued decryption of those objects.

It restricts the KMS key usage to only those AWS services that are natively integrated with the specified VPC endpoint in the local region.

Why wrong: The policy does not restrict which AWS services can use the key; rather, it restricts the network origin of the API call. While integrated services might use the key, they would also need to be operating within the context of that specific VPC endpoint to satisfy the condition defined in the policy.

It grants the VPC endpoint itself the administrative permissions to manage the KMS key lifecycle, including deletion and rotation.

Why wrong: A VPC endpoint is a piece of network infrastructure and cannot be an IAM principal that performs actions. The policy allows principals (users or roles) to perform actions 'through' the endpoint. It does not grant the endpoint itself any permissions to manage the key or its lifecycle independently.

It ensures that all data encrypted by this key can only be decrypted by resources residing within the subnet associated with the VPC endpoint.

Why wrong: The policy controls access to the KMS API actions, not the physical location of the data. While the request must come through the VPC endpoint, the resources (like EC2 instances) don't necessarily have to be in a specific subnet, as long as they can reach and use that specific VPC endpoint.

Enable EBS encryption by default for the AWS Region and specify the Customer Managed Key as the default encryption key.

Why wrong: Enabling EBS encryption by default is a regional setting that ensures all new volumes and snapshot copies are encrypted. If a volume is created from an unencrypted snapshot, EBS automatically encrypts the resulting volume using the default CMK, providing a seamless and mandatory security layer for all block storage.

Create an IAM policy that denies the ec2:CreateVolume action if the 'Encrypted' parameter is set to false and attach it to all users.

Why wrong: An IAM policy can enforce encryption during volume creation, but it requires users to manually specify encryption settings and keys. It is less efficient than 'encryption by default' because it leads to failed API calls and does not automatically handle the encryption process for the user during the creation of the resource.

Use AWS Config to detect unencrypted EBS volumes and trigger an AWS Systems Manager Automation document to stop and encrypt them.

Why wrong: This approach is reactive rather than proactive. It allows unencrypted volumes to be created and data to be written before the remediation occurs. Furthermore, encrypting an existing volume requires creating a snapshot and a new volume, which causes downtime and significant operational overhead compared to encryption by default.

Modify the existing RDS DB instance and enable the 'StorageEncrypted' parameter while specifying the KMS key ARN.

Why wrong: The 'StorageEncrypted' attribute of an RDS instance is immutable. You cannot modify an existing unencrypted instance to enable encryption. This design choice by AWS ensures that encryption is built into the storage layer from the start and prevents the complexities of encrypting large amounts of data on a live system.

Enable the 'AutoMinorVersionUpgrade' feature to allow RDS to automatically apply encryption during the next maintenance window.

Why wrong: AutoMinorVersionUpgrade is intended for patching and minor software updates, not for fundamental changes to the underlying storage architecture like encryption. Enabling encryption is a disruptive change that requires data movement and cannot be performed as part of a minor version upgrade or standard maintenance task.

Switch from using Customer Managed Keys (CMKs) to AWS Managed Keys (aws/s3), as managed keys have higher request limits and lower costs.

Why wrong: AWS Managed Keys and Customer Managed Keys generally share the same request quotas and pricing for cryptographic operations. Switching to a managed key does not solve the fundamental issue of the volume of API calls being made for billions of objects, nor does it provide the cost-saving benefits of S3 Bucket Keys.

Implement an Amazon CloudFront distribution in front of the S3 bucket and enable 'Origin Request Caching' for KMS metadata.

Why wrong: CloudFront caches content, but it does not cache KMS cryptographic operations or metadata. Each time an object is retrieved and needs to be decrypted, a call to KMS is still required if the object is encrypted with SSE-KMS. CloudFront caching cannot mitigate the KMS API costs or limits associated with S3 server-side encryption.

Use S3 Batch Operations to re-encrypt all objects with SSE-S3 (AES-256) instead of SSE-KMS.

Why wrong: While SSE-S3 does not incur KMS costs, it also does not provide the security features of KMS, such as key rotation control and audit logging in CloudTrail for key usage. For many organizations, the security requirements mandate the use of KMS, making S3 Bucket Keys a better optimization than switching to SSE-S3.