Exam AWS Certified Solutions Architect - Professional topic 1 question 787 discussion

is ABC not ACD why ? the option C "force" choose the B by "aws:kms" condition

ABC - must use CMK to avoid public access of an unauthorized users (no access to the key) Must enforce header of aws:KMS in order to make sure all object are encrypted with CMK (SSE-KMS) Finally need to make sure aws:SecureTransport is set to true which means SSL

In order to enforce object encryption, create an S3 bucket policy that denies any S3 Put request that does not include the x-amz-server-side-encryption header. There are two possible values for the x-amz-server-side-encryption header: AES256, which tells S3 to use S3-managed keys, and aws:kms, which tells S3 to use AWS KMS–managed keys.

Due to the requirement of the Data Lake, ABC is better than ADE. That needs SSE-KMS but not SSE-S3. https://aws.amazon.com/blogs/big-data/build-secure-encrypted-data-lakes-with-aws-lake-formation/

A,B,C is correct. In my opinion, If you are using SSE-S3 since you have access to the bucket, S3 service will automatically decrypt the file for you, but with SSE-KMS we have: "To upload an object encrypted with an AWS KMS key to Amazon S3, you need kms:GenerateDataKey permissions on the key. To download an object encrypted with an AWS KMS key, you need kms:Decrypt permissions.", from https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html Then, just making the S3 bucket public is not enough to have access to files, you also need access to KMS.

I'll go ABC A - to use encryption at rest SSL should be enabled B - Create Key C - Require Key on PutObject

A,B,C is correct. Reason SSE-S3 is not appropriate is that if the user has access privileges to S3 then they will automatically have access to the S3 key as well.