A security policy requires that every S3 upload is refused unless the request carries the required server-side encryption header. Uploads without an x-amz-server-side-encryption header must be automatically rejected. How should the bucket be configured?
Show answer and explanation
Answer: B
A bucket policy can carry an explicit Deny on s3:PutObject that only lifts when the request includes an x-amz-server-side-encryption header with an approved algorithm such as AES256 or aws:kms. The rejection happens in the server-side authorization decision, so the non-compliant write never lands and there is no post-hoc cleanup.
Attaching the condition to the PutObject permission makes the encryption header mandatory for every writer, no matter which IAM identity or client submits the request.
Why the other options are wrong
- A. Default encryption silently encrypts uploads that omit the header, so nothing is ever rejected; that protects data at rest but does not satisfy the requirement that non-compliant requests be refused.
- C. Block Public Access governs public visibility of objects and buckets and has no relationship to the encryption headers a client sends on upload.
- D. A Config rule detects unencrypted objects only after they have been stored, and deleting them later leaves a window of non-compliant data at rest rather than rejecting the request.