0
0
AWScloud~10 mins

S3 encryption options in AWS - Interactive Code Practice

Choose your learning style9 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime
Practice - 5 Tasks
Answer the questions below
1fill in blank
easy

Complete the code to enable server-side encryption with Amazon S3-managed keys.

AWS
bucket = s3.Bucket('my-bucket')
bucket.put_object(Key='file.txt', Body=data, ServerSideEncryption='[1]')
Drag options to blanks, or click blank then click option'
ARSA
BAES256
Caws:kms
DNONE
Attempts:
3 left
💡 Hint
Common Mistakes
Using 'aws:kms' instead of 'AES256' for S3-managed encryption.
2fill in blank
medium

Complete the code to enable server-side encryption with AWS KMS-managed keys.

AWS
bucket = s3.Bucket('my-bucket')
bucket.put_object(Key='file.txt', Body=data, ServerSideEncryption='[1]')
Drag options to blanks, or click blank then click option'
ANONE
BAES256
Caws:kms
DRSA
Attempts:
3 left
💡 Hint
Common Mistakes
Using 'AES256' instead of 'aws:kms' for KMS encryption.
3fill in blank
hard

Fix the error in the bucket policy to require server-side encryption with AWS KMS.

AWS
"Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption": "[1]"}}
Drag options to blanks, or click blank then click option'
ARSA
BNONE
CAES256
Daws:kms
Attempts:
3 left
💡 Hint
Common Mistakes
Using 'AES256' in the condition instead of 'aws:kms'.
4fill in blank
hard

Fill both blanks to configure bucket default encryption with AWS KMS and specify the key ID.

AWS
bucket_encryption = {
  'ServerSideEncryptionConfiguration': [
    {
      'ServerSideEncryptionByDefault': {
        'SSEAlgorithm': '[1]',
        'KMSMasterKeyID': '[2]'
      }
    }
  ]
}
Drag options to blanks, or click blank then click option'
Aaws:kms
BAES256
C1234abcd-12ab-34cd-56ef-1234567890ab
Dnone
Attempts:
3 left
💡 Hint
Common Mistakes
Using 'AES256' as algorithm with a KMS key ID.
5fill in blank
hard

Fill the blanks to create a bucket policy that denies uploads without server-side encryption using AES256 or AWS KMS.

AWS
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyUnEncryptedObjectUploads",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": ["[1]", "[2]"]
        }
      }
    }
  ]
}
Drag options to blanks, or click blank then click option'
AAES256
Baws:kms
CNONE
DRSA
Attempts:
3 left
💡 Hint
Common Mistakes
Including 'NONE' or 'RSA' which are invalid encryption options.