CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Enforcing Encryption for S3 Data Uploads
Learn how to enforce encrypted connections for S3 data uploads with this detailed exam question walkthrough.
A compliance rule requires that data uploaded to an S3 bucket is always transmitted over encrypted connections. This requirement can trip up candidates, especially when they consider the various features of S3. Knowing exactly how to enforce this rule is crucial for the AWS Certified Solutions Architect - Associate exam.
The question
A compliance rule requires that data uploaded to an S3 bucket is always transmitted over encrypted connections. How can this be enforced?
A. Enable S3 versioning
B. Add a bucket policy that denies requests where aws:SecureTransport is false
C. Enable static website hosting
D. Turn on S3 Transfer Acceleration
Think before you scroll
Before looking for the answer, consider the specific requirement: data must be transmitted over encrypted connections. Each option has different implications for the S3 bucket's functionality and security. Focus on how each choice relates to enforcing encryption during data transmission.
The answer
The correct option is B: Add a bucket policy that denies requests where aws:SecureTransport is false. This policy explicitly denies any requests that do not use HTTPS, ensuring that all data uploaded to the S3 bucket is transmitted securely.
Why the other options lose
A. Enable S3 versioning: While versioning is useful for maintaining multiple copies of an object, it does not enforce encryption during data transmission. It is focused on data retention rather than security protocols.
C. Enable static website hosting: This option allows the S3 bucket to serve static content over HTTP or HTTPS. However, it does not provide any mechanism to enforce encryption for data uploads, making it irrelevant to the compliance requirement.
D. Turn on S3 Transfer Acceleration: Transfer Acceleration speeds up the upload and download of files to and from S3. While it can improve performance, it does not enforce encrypted connections and thus fails to meet the compliance rule.
The concept behind it
The principle here is about enforcing security policies through bucket policies. By setting conditions in the policy, you can control how data is accessed and transmitted. This is essential for maintaining compliance with security and regulatory requirements.
Exam trap to remember
Always remember: use bucket policies to enforce encryption in transit. If a compliance rule mentions secure transmission, look for options that involve policies or conditions on secure protocols.