Question

A SysOps administrator must ensure that any newly created Amazon S3 bucket in the company's account is automatically checked, and if it does not have default encryption enabled, encryption must be applied without human intervention. AWS CloudTrail is already enabled and delivering management events. Which approach meets this requirement with the LEAST operational overhead?

Accepted Answer

Create an Amazon EventBridge rule that matches the CreateBucket event from CloudTrail and triggers a Lambda function that enables default encryption on the bucket.

Answer

Configure an Amazon S3 event notification for the s3:ObjectCreated event that invokes a Lambda function to enable bucket encryption.

Answer

Create a CloudWatch alarm on the NumberOfObjects metric that sends an SNS notification to the operations team to manually enable encryption.

Answer

Schedule an EventBridge rule to run every hour that invokes a Lambda function to scan all buckets and enable encryption where missing.