SOA-C02 aws:SecureTransport Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use Amazon CloudFront with the S3 bucket as origin and require HTTPS.

  Why it's wrong here

  Configuring CloudFront with an S3 origin and requiring HTTPS for viewer requests only encrypts traffic between the client and the CloudFront edge location. By default, CloudFront may use HTTP or HTTPS when fetching from the origin depending on the origin protocol policy, and unless you set that policy to 'HTTPS Only' and add a bucket policy that denies insecure transport, the origin connection can be plaintext. Even with HTTPS to CloudFront, direct requests to the bucket are unaffected, so this option does not ensure all traffic to the S3 bucket is encrypted.

• ✗

  Create a VPC endpoint for S3 and route all traffic through it.

  Why it's wrong here

  A VPC endpoint for S3, whether gateway or interface type, routes traffic from your VPC to S3 over the AWS private network, avoiding the public internet, but it does not enforce encryption. The traffic between your VPC and S3 is still delivered as originally sent, so a client could use HTTP and the request would succeed. To ensure encryption in transit, you must still add a bucket policy that denies requests where aws:SecureTransport is false; the endpoint alone only addresses network path, not data security.

• ✗

  Enable default encryption on the S3 bucket.

  Why it's wrong here

  Default encryption on an S3 bucket protects data at rest by applying server-side encryption (SSE-S3, SSE-KMS, or SSE-C) when objects are written, but it does nothing to prevent a client from sending requests over plain HTTP. The encryption applies after the data reaches S3, so traffic in transit remains unencrypted. Therefore, enabling default encryption does not satisfy the requirement to ensure all traffic is encrypted in transit.

• ✓

  Add a bucket policy that denies requests where aws:SecureTransport is false.

  Why this is correct

  This bucket policy explicitly denies any request for which the aws:SecureTransport condition is false, meaning the request was not made over HTTPS or TLS. Because a deny in an identity-based or bucket policy overrides any allows, every request must present a valid TLS connection or it will be rejected. This enforces encryption in transit at the S3 bucket level for all clients, including those using the public endpoint, and is the standard method for ensuring HTTPS-only access.

Go deeper

Related to this question