S3 encryption options in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable server-side encryption with Amazon S3-managed keys.

AWS

bucket = s3.Bucket('my-bucket')
bucket.put_object(Key='file.txt', Body=data, ServerSideEncryption='[1]')

Drag options to blanks, or click blank then click option'

ARSA

BAES256

Caws:kms

DNONE

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'aws:kms' instead of 'AES256' for S3-managed encryption.

Using AES256 enables server-side encryption with Amazon S3-managed keys.

2fill in blank

medium

Complete the code to enable server-side encryption with AWS KMS-managed keys.

AWS

bucket = s3.Bucket('my-bucket')
bucket.put_object(Key='file.txt', Body=data, ServerSideEncryption='[1]')

Drag options to blanks, or click blank then click option'

ANONE

BAES256

Caws:kms

DRSA

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'AES256' instead of 'aws:kms' for KMS encryption.

Using aws:kms enables server-side encryption with AWS KMS-managed keys.

3fill in blank

hard

Fix the error in the bucket policy to require server-side encryption with AWS KMS.

AWS

"Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption": "[1]"}}

Drag options to blanks, or click blank then click option'

ARSA

BNONE

CAES256

Daws:kms

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'AES256' in the condition instead of 'aws:kms'.

The policy must check for aws:kms to enforce KMS encryption.

4fill in blank

hard

Fill both blanks to configure bucket default encryption with AWS KMS and specify the key ID.

AWS

bucket_encryption = {
  'ServerSideEncryptionConfiguration': [
    {
      'ServerSideEncryptionByDefault': {
        'SSEAlgorithm': '[1]',
        'KMSMasterKeyID': '[2]'
      }
    }
  ]
}

Drag options to blanks, or click blank then click option'

Aaws:kms

BAES256

C1234abcd-12ab-34cd-56ef-1234567890ab

Dnone

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'AES256' as algorithm with a KMS key ID.

Use aws:kms for the algorithm and provide the KMS key ID string.

5fill in blank

hard

Fill the blanks to create a bucket policy that denies uploads without server-side encryption using AES256 or AWS KMS.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyUnEncryptedObjectUploads",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": ["[1]", "[2]"]
        }
      }
    }
  ]
}

Drag options to blanks, or click blank then click option'

AAES256

Baws:kms

CNONE

DRSA

Attempts:

3 left

💡 Hint

Common Mistakes

Including 'NONE' or 'RSA' which are invalid encryption options.

The policy denies uploads unless the encryption is either AES256 or aws:kms.

Practice

1. What does enabling default encryption on an S3 bucket do?

easy

A. Allows only public access to the bucket

B. Deletes unencrypted objects from the bucket

C. Prevents any uploads to the bucket

D. Automatically encrypts all objects uploaded to the bucket

Solution

1. Step 1: Understand default encryption purpose

   Default encryption ensures all new objects are encrypted automatically when uploaded.

2. Step 2: Analyze options

   Only Automatically encrypts all objects uploaded to the bucket describes automatic encryption of all uploads, others describe unrelated or incorrect behaviors.

3. Final Answer:

   Automatically encrypts all objects uploaded to the bucket -> Option D

4. Quick Check:

   Default encryption = automatic encryption [OK]

Hint: Default encryption means all uploads get encrypted automatically [OK]

Common Mistakes:

• Thinking encryption deletes files
• Confusing encryption with access control
• Believing encryption blocks uploads

2. Which of the following is the correct way to specify AES256 server-side encryption in an S3 PutObject API call?

easy

A. "ServerSideEncryption": "AES256"

B. "Encryption": "SSE-S3"

C. "EncryptionMethod": "AES256"

D. "ServerSideEncryption": "aws:kms"

Solution

1. Step 1: Recall correct parameter name and value

   The correct parameter is ServerSideEncryption with value "AES256" for AWS-managed keys.

2. Step 2: Check options

   "ServerSideEncryption": "AES256" matches the exact syntax; others use wrong keys or values.

3. Final Answer:

   "ServerSideEncryption": "AES256" -> Option A

4. Quick Check:

   Correct key and value for AES256 = "ServerSideEncryption": "AES256" [OK]

Hint: Use ServerSideEncryption: AES256 for simple AWS-managed encryption [OK]

Common Mistakes:

• Using wrong parameter names
• Confusing KMS and AES256 values
• Using unsupported encryption keys

3. Given this AWS CLI command to upload a file with KMS encryption:
aws s3 cp file.txt s3://mybucket/ --sse aws:kms --sse-kms-key-id 1234abcd-12ab-34cd-56ef-1234567890ab
What will happen if the KMS key ID is invalid?

medium

A. The file uploads with AES256 encryption instead

B. The file uploads without encryption

C. The upload fails with an error

D. The file uploads but is inaccessible

Solution

1. Step 1: Understand KMS key validation

   AWS checks the KMS key ID during upload; if invalid, it rejects the request.

2. Step 2: Analyze upload behavior on invalid key

   Upload fails with an error because encryption cannot proceed without a valid key.

3. Final Answer:

   The upload fails with an error -> Option C

4. Quick Check:

   Invalid KMS key = upload error [OK]

Hint: Invalid KMS key causes upload failure, not fallback [OK]

Common Mistakes:

• Assuming fallback to AES256
• Thinking upload succeeds without encryption
• Believing file becomes inaccessible silently

4. You configured an S3 bucket with default encryption using AWS KMS, but uploads from your app fail with an AccessDenied error. What is the most likely cause?

medium

A. The app lacks permission to use the KMS key

B. The bucket policy denies all uploads

C. The app is uploading unencrypted files

D. The bucket encryption is disabled

Solution

1. Step 1: Understand KMS permission requirements

   Using KMS encryption requires the uploader to have permission to use the KMS key.

2. Step 2: Analyze error cause

   AccessDenied during upload with KMS encryption usually means missing KMS key permissions.

3. Final Answer:

   The app lacks permission to use the KMS key -> Option A

4. Quick Check:

   KMS permission missing = AccessDenied error [OK]

Hint: Check KMS key permissions if AccessDenied on encrypted upload [OK]

Common Mistakes:

• Assuming bucket policy denies uploads
• Ignoring KMS key permissions
• Thinking encryption is disabled

5. You want to ensure all objects in your S3 bucket are encrypted using your own KMS key, but also want to allow some users to upload unencrypted files temporarily. Which approach is best?

hard

A. Enable default bucket encryption with your KMS key and use a bucket policy to deny unencrypted uploads

B. Enable default encryption with your KMS key and use a bucket policy that allows unencrypted uploads only for specific users

C. Enable default encryption with your KMS key and create an IAM policy allowing specific users to bypass encryption

D. Do not enable default encryption and require users to specify encryption manually

Solution

1. Step 1: Understand default encryption and exceptions

   Default encryption applies to all uploads unless bucket policy allows exceptions.

2. Step 2: Analyze options for allowing unencrypted uploads temporarily

   Bucket policies can allow unencrypted uploads for specific users while default encryption is enabled.

3. Step 3: Evaluate options

   Enable default encryption with your KMS key and use a bucket policy that allows unencrypted uploads only for specific users correctly uses bucket policy exceptions; Enable default bucket encryption with your KMS key and use a bucket policy to deny unencrypted uploads denies unencrypted uploads completely; Do not enable default encryption and require users to specify encryption manually lacks default encryption; Enable default encryption with your KMS key and create an IAM policy allowing specific users to bypass encryption cannot bypass encryption via IAM policy.

4. Final Answer:

   Enable default encryption with your KMS key and use a bucket policy that allows unencrypted uploads only for specific users -> Option B

5. Quick Check:

   Bucket policy exceptions allow controlled unencrypted uploads [OK]

Hint: Use bucket policy exceptions to allow unencrypted uploads with default encryption [OK]

Common Mistakes:

• Thinking IAM policies can bypass bucket encryption
• Disabling default encryption to allow exceptions
• Denying all unencrypted uploads without exceptions