Exam AWS Certified Security - Specialty topic 1 question 473 discussion

Option C provides the appropriate measures to encrypt all data at rest and enforce least privilege data access controls: Create a key policy that allows the kms:Decrypt action only for Amazon S3, DynamoDB, Lambda, and Amazon EKS: This ensures that only authorized services or resources that require access to the encrypted data can decrypt it using the AWS KMS customer managed key. By allowing decryption only for specific services, you can enforce least privilege access controls. Create an SCP that denies the creation of S3 buckets and DynamoDB tables that are not encrypted with the key: By implementing a Service Control Policy (SCP), you can enforce the use of the specified encryption key for creating S3 buckets and DynamoDB tables. This prevents the creation of unencrypted data resources and ensures consistent encryption practices across the organization.

s3:CreateBucket action cannot be limited with a specific encryption key config, so C is wrong.

Answer must be D. C is wrong because as per https://docs.aws.amazon.com/AmazonS3/latest/userguide/list_amazons3.html - the s3:x-amz-server-side-encryption* condition keys are not available for the s3:CreateBucket action. If C was worded differently to say "Create an SCP that denies the upload of unencrypted objects into S3 buckets and DynamoDB tables" then C would be correct, because the s3:PutObject action has the s3:x-amz-server-side-encryption* condition keys. Btw, SCPs are totally capable of this sort of enforcement.

Answer C SCP to prevent unencrypted uploads ensures even if the bucket is created without kms, it won't allow unencrypted data at rest. Basically forcing Ops to re-create the bucket correctly. https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_s3.html DynamoDB encrypts data at rest by default https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html

As far as I know, you can't use an SCP to deny the creation of S3 buckets and DynamoDB tables that are not encrypted with the key. This functionality is way too high level for an SCP.

I would select D

Same as kuber2023, not sure if C is the right answer as I was not able to find the right condition key to use for this scenario: https://docs.aws.amazon.com/AmazonS3/latest/userguide/list_amazons3.html But it is definitely possible to use a config rule (s3-bucket-server-side-encryption-enabled) to check for publicly accessible buckets and send notifications (it can also be expanded to enforce automatic remediation to delete those buckets...) https://asecure.cloud/a/ar_ssm_s3_bucket_encryption/

C might look right but I don't think there's any such condition available that can restrict the creation of S3 bucket or DDB table using SCP. Happy to be proven wrong!

Service principals can be used in a key policy. It is highly recommended to use a the aws:SourceArn or aws:SourceAccount global condition keys. https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html

SCP to enforce use of KMS

C makes sense