How to Enforce Specific KMS Key for S3 Encryption Using Bucket Policy
A company has an S3 bucket that stores sensitive customer data. The security team requires that all objects uploaded to the bucket must be encrypted at rest using AWS KMS with a specific customer managed key. Which bucket policy condition should be used to enforce this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms", "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}
It uses both conditions: 's3:x-amz-server-side-encryption' set to 'aws:kms' ensures that objects are encrypted with SSE-KMS, and 's3:x-amz-server-side-encryption-aws-kms-key-id' set to the specific key ARN ensures that only the designated customer managed key is used. Option A enforces KMS encryption but does not restrict which KMS key, allowing any managed key. Option C enforces a specific key ARN but does not require the encryption header to be present, which could allow objects without encryption if the key ID header is omitted (though in practice, the key ID is only valid with SSE-KMS, the condition alone is not sufficient to guarantee encryption). Option D uses a 'Null' condition incorrectly and would not properly enforce encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}
Why it's wrong here
This only enforces KMS encryption but does not restrict which KMS key can be used; any KMS key would be accepted.
- ✓
"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms", "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}
Why this is correct
Combines both conditions to enforce KMS encryption and the specific customer managed key, meeting the requirement.
- ✗
"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}
Why it's wrong here
This requires the specific key but does not enforce that the encryption is KMS; a request without encryption header would fail, but the condition alone is insufficient.
- ✗
"Condition": {"Null": {"s3:x-amz-server-side-encryption": "false"}}
Why it's wrong here
The Null condition checks if the header is absent; 'false' means the header must be present, but it doesn't enforce KMS specifically.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an S3 bucket that stores sensitive customer data. The security team requires that all objects in the bucket be encrypted at rest using AWS KMS. An administrator notices that some objects are not encrypted. What is the MOST efficient way to enforce encryption for future uploads?
hard- A.Use an SCP to require KMS encryption for all S3 actions.
- B.Use AWS Config to detect unencrypted objects and automatically encrypt them.
- ✓ C.Add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to aws:kms.
- D.Enable S3 default encryption on the bucket with KMS.
Why C: Adding a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to aws:kms is the most efficient way to enforce encryption for future uploads. This policy prevents any upload without proper encryption. Option A is incorrect because SCPs (Service Control Policies) limit IAM permissions but do not directly enforce encryption on S3 objects. Option B is incorrect because AWS Config can detect unencrypted objects but does not automatically encrypt them; it is a reactive measure. Option D is incorrect because S3 default encryption can be overridden by the client specifying a different encryption header in the upload request.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.