Question

A financial services company classifies data into three tiers: Public, Internal, and Restricted. Restricted data must be encrypted with a dedicated KMS customer managed key, and the security team requires that any object tagged 'classification=Restricted' stored in S3 be encrypted only with that specific key. Developers currently upload objects using SSE-KMS but can select any KMS key in the account. The security team wants to enforce that Restricted-classified uploads fail unless the correct CMK is used, while allowing other keys for lower tiers. Which approach BEST enforces this requirement?

Accepted Answer

Apply an S3 bucket policy that denies s3:PutObject when the request tag 'classification' equals 'Restricted' and the s3:x-amz-server-side-encryption-aws-kms-key-id condition does not match the dedicated CMK ARN.

Answer

Set the bucket's default encryption to the dedicated CMK and enable a bucket key so all objects automatically use the Restricted key regardless of classification.

Answer

Attach a key policy to the dedicated CMK that denies kms:Encrypt unless the caller passes an encryption context of 'classification=Restricted'.

Answer

Create an SCP that denies s3:PutObject across the organization unless the request specifies the dedicated CMK ARN as the encryption key.