SCS-C02 Data Protection Practice Question
A company wants to encrypt data at rest in Amazon S3 using server-side encryption with Amazon S3-managed keys (SSE-S3). What is the minimum permission required for an IAM user to upload an object that will be encrypted with SSE-S3?
⚠ Common exam trap
SCS-C02 often tests the confusion between SSE-S3 and SSE-KMS permission requirements, tempting candidates to select KMS permissions (kms:GenerateDataKey, kms:Decrypt) for SSE-S3 when S3 manages keys internally and no KMS permissions are needed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:PutObject
For SSE-S3, Amazon S3 manages the encryption keys entirely, so the IAM user does not need any AWS KMS permissions. The only permission required to upload an object with SSE-S3 is s3:PutObject, which allows the upload operation. S3 automatically encrypts the object with an S3-managed key when the request specifies SSE-S3 or when default encryption is enabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
s3:PutObjectAcl
Why it's wrong here
This permission is for managing object Access Control Lists (ACLs) after an object is uploaded, such as changing read/write permissions for other AWS accounts or making an object public. It plays no role in the server-side encryption process; SSE-S3 automatically encrypts objects upon write using S3-managed keys without requiring any encryption-specific action from the caller. Granting only s3:PutObjectAcl would not allow the initial PUT request to succeed, and adding it to an encryption policy doesn't affect whether encryption is applied.
- ✗
kms:Decrypt
Why it's wrong here
This KMS permission is used to decrypt ciphertext that was encrypted under a customer master key, which is needed when reading or processing data encrypted with SSE-KMS. For SSE-S3, S3 uses its own native encryption keys that are never exposed to the caller, so there is no KMS operation involved during either upload or download. Including kms:Decrypt in an IAM policy for SSE-S3 is unnecessary and could inadvertently grant broader data access than intended, but it does not enable or disable encryption.
- ✓
s3:PutObject
Why this is correct
This is the correct permission needed to upload any object to S3, regardless of whether server-side encryption is enabled. When using SSE-S3, S3 automatically encrypts the object with a unique key that is itself wrapped by a master key managed by S3, all happening transparently in the service. The caller only needs the standard s3:PutObject permission; no separate KMS or encryption-specific permissions are required for the upload to succeed with encryption.
- ✗
kms:GenerateDataKey
Why it's wrong here
This KMS permission is specifically required when using SSE-KMS, because the client or S3 must call KMS to generate a data key that encrypts the object. With SSE-S3, S3 manages all encryption keys entirely within its own infrastructure, so the caller never invokes KMS and does not need kms:GenerateDataKey. Requesting this permission in an IAM policy would be relevant only for customer-managed CMK scenarios, not for the default SSE-S3 encryption option.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.