Exam AWS Certified Security - Specialty topic 1 question 439 discussion

C: As part of copying the objects, specify that S3 should encrypt the object with SSE-S3 or SSE-KMS encryption. This job copies the objects, so all your objects show an updated creation date upon completion, regardless of when you originally added them to S3. You also must specify the other properties for your set of objects as part of the S3 Batch Operations job, including object tags and storage class. https://aws.amazon.com/blogs/storage/encrypting-objects-with-amazon-s3-batch-operations/

I asked to BARD. he gave this awser. and I will say B. ME:are you sure this? some people saying answer is C. Sure, let's take a look at option C as well: C. Create a new AWS Key Management Service (AWS KMS) customer managed key. Configure annual automatic key rotation. Enable server-side encryption with AWS KMS keys (SSE-KMS) for the S3 bucket. Use an S3 Batch Operations job with the COPY command to change all the objects in the S3 bucket to use the customer managed key. Configure the EC2 instance profile with permissions to use the customer managed key. Option C is also a valid approach, but it does not meet the requirement for key rotation once every year. The S3 Batch Operations job will only encrypt the objects in the S3 bucket once, and the customer managed key will not be rotated until the next year. Option B, on the other hand, meets all of the requirements. The customer managed key will be rotated annually, which will help to mitigate the risk of unauthorized access to the data.

C Answer B does not encrypt currently unencrypted objects. Also, once server side encryption is enabled, there isn't a need for a bucket policy to enforce encryption on new objects.

B. Create a new AWS Key Management Service (AWS KMS) customer managed key. Configure annual automatic key rotation. Enable server-side encryption with AWS KMS keys (SSE-KMS) for the S3 bucket. Add a bucket policy to the S3 bucket to enforce SSE-KMS encryption. Configure the EC2 instance profile with permissions to use the customer managed key. This option meets all the requirements stated in the question. By creating a new AWS KMS customer managed key and configuring annual key rotation, you address the encryption at rest and key rotation requirements. Enabling server-side encryption with SSE-KMS for the S3 bucket ensures that new objects are encrypted at rest. Adding a bucket policy to enforce SSE-KMS encryption will ensure all new objects uploaded to the bucket are encrypted. Finally, configuring the EC2 instance profile with permissions to use the customer managed key allows the application to read and write encrypted objects in the S3 bucket.

Selected c

C is correct