Question

A security engineer must ensure that any S3 bucket created in the company's production account is automatically flagged as noncompliant if default encryption is not enabled, and then automatically remediated to enable SSE-S3 encryption without manual intervention. Configuration drift must be continuously evaluated as changes occur. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Enable AWS Config with the managed rule s3-bucket-server-side-encryption-enabled and attach an SSM Automation remediation action that enables default encryption on noncompliant buckets.

Answer

Create a CloudWatch Logs metric filter on CloudTrail PutBucketEncryption events and trigger a Lambda function to encrypt buckets when the filter matches.

Answer

Schedule an AWS Lambda function every hour to list all buckets, check each bucket's encryption configuration, and enable SSE-S3 where missing.

Answer

Enable Amazon Macie to scan all buckets and use its findings to trigger an EventBridge rule that enables default encryption on unencrypted buckets.