Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 170 discussion

The "Null" condition key with "true" ensures that the s3:x-amz-server-side-encryption-customer-algorithm header must be present in the s3:PutObject request. This header specifies the use of SSE-C.

Deny: This Deny statement ensures that the action is blocked unless the specified condition is met. s3:PutObject: This is the action that allows uploading objects to S3. Condition: The condition enforces that the upload must include the SSE-C encryption header. The key s3:x-amz-server-side-encryption-customer-algorithm must be set to a valid encryption algorithm (such as AES256) to use SSE-C. StringNotEqualsIfExists: This condition ensures that if the header is not present in the request, it is denied. This SCP effectively enforces the requirement that all object uploads to the specified S3 bucket(s) must use SSE-C with the specified encryption algorithm.

Condition: The condition specifies that the s3:x-amz-server-side-encryption-customer-algorithm key must not be null (Null: "true"). If this key is absent, the condition evaluates to true, and the Deny effect is applied.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html

A is correct

A - Correct Answer https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html#ssec-require-condition-key