Question

A company stores sensitive customer data in an Amazon S3 bucket. A compliance audit requires that all requests to the bucket must use encryption in transit, and any request made over an unencrypted connection must be denied. The SysOps administrator must enforce this at the bucket level without modifying application code. Which action meets this requirement?

Accepted Answer

Add a bucket policy with an explicit Deny statement using the condition aws:SecureTransport set to false.

Answer

Enable default encryption on the bucket using SSE-S3 to protect the objects.

Answer

Attach an S3 Access Point and require that clients connect through it using HTTPS.

Answer

Enable S3 Block Public Access and turn on server access logging for the bucket.