Compliance requires every S3 bucket to use SSE-KMS with a customer managed key. Buckets that do not meet the rule must be corrected automatically within minutes of creation, with an auditable record. Which design should be used?
Show answer and explanation
Answer: A
A change-triggered Config rule re-evaluates a bucket as soon as its configuration changes, records the compliance result, and can run a remediation action automatically. The managed remediation document for S3 encryption applies the required algorithm and key, and every evaluation and remediation attempt is logged, which satisfies the audit requirement.
Because the rule and the remediation are managed resources, no custom code has to be written, tested, or patched.
Why the other options are wrong
- B. A Lambda function can react quickly, but it is code you own, it leaves no compliance history, and it only covers buckets created after the rule exists.
- C. S3 event notifications fire on object events, not on bucket creation, so a new bucket with weak encryption would go unnoticed.
- D. A template only governs buckets that the template creates; buckets made by other teams or tools stay unprotected and no record is produced.