A company is providing read access to objects in an Amazon S3 bucket for different customers. The company uses 1AM permissions to restrict access to…

The requirement is to enforce encryption in transit for all S3 interactions. This is achieved by ensuring all requests to the S3 bucket use HTTPS (SSL/TLS). The aws:SecureTransport global condition key in an IAM or bucket policy is specifically designed for this purpose. By creating a bucket policy with a Deny effect for any S3 action where aws:SecureTransport is false, you effectively reject all non-HTTPS (i.e., HTTP) requests. This policy applies to all users and roles accessing the bucket, ensuring compliance with the regulation.

B. The s3:x-amz-acl condition key is used to control object Access Control Lists (ACLs), which manage permissions for data at rest, not encryption in transit.

C. Enforcing the use of the AWS SDK is an indirect and unreliable method. A user could still use other tools to make insecure requests, and there is no direct policy condition to enforce SDK usage.

D. This option also uses the s3:x-amz-acl condition key, which relates to object ACLs and does not enforce the use of HTTPS for data in transit.

1. Amazon S3 User Guide: "Requiring encryption in transit". This document provides a direct example of a bucket policy to enforce encryption in transit. It states

"To require encryption in transit

you can create an S3 bucket policy that denies access to HTTP requests... The following bucket policy denies access to any S3 action on objects in the specified bucket if the request is not encrypted in transit." The example policy uses the aws:SecureTransport condition key set to false with a Deny effect.

2. AWS IAM User Guide: "AWS global condition context keys". This guide officially documents the aws:SecureTransport key

describing it as a boolean that "Checks whether the request was sent using SSL." This confirms it is the correct key for verifying transport-level encryption.

3. Amazon S3 User Guide: "Amazon S3 condition keys". This page details the s3:x-amz-acl condition key

explaining that it checks the value of the x-amz-acl request header. This confirms that options B and D are related to object-level permissions (ACLs)

not transport security.