Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

Configure a customer managed KMS key for supported Lambda environment encryption would help if a Lambda runtime has environment secrets encrypted using an AWS managed key but policy demands customer key control. Customer managed keys allow more key policy oversight. That is not the symptom described here: an AWS service should access a secret without broad administrator permission. The matching response is Grant only secret-specific read actions to its role and key-decrypt when required, because service roles should not inherit global secret-management powers.

For the alternative failure a secret is rotated but an ECS service retains old environment values, the control Restart or redeploy affected tasks to load refreshed injected secrets is relevant: environment-injected secrets do not automatically refresh running containers. Here the evidence instead is an AWS service should access a secret without broad administrator permission. The selected technical mechanism is Grant only secret-specific read actions to its role and key-decrypt when required: service roles should not inherit global secret-management powers.

Avoid logging secret environment values and restrict container log viewers solves a different operational problem where an ECS task logs injected secret values on startup. Log confidentiality is separate from runtime secret injection. It does not directly address an AWS service should access a secret without broad administrator permission. The case calls for Grant only secret-specific read actions to its role and key-decrypt when required, since service roles should not inherit global secret-management powers.

For the alternative failure eFS mounts must be restricted to authorized EC2 hosts and IAM callers, the control Combine mount-target security groups, file-system policy and IAM authorization is relevant: eFS network and resource permissions govern mount access. Here the evidence instead is a shared Linux filesystem must encrypt file data at rest. The selected technical mechanism is Create encrypted Amazon EFS file systems using an approved KMS key: eFS encryption protects stored file data.

Use AWS Config encryption compliance rules and remediation workflows solves a different operational problem where a shared backup process needs to ensure no unencrypted EBS volumes remain. Config detection identifies noncompliant storage configurations. It does not directly address a shared Linux filesystem must encrypt file data at rest. The case calls for Create encrypted Amazon EFS file systems using an approved KMS key, since eFS encryption protects stored file data.

The competing option Copy eligible snapshots with approved encryption and cross-account key permissions would be useful when application EBS snapshots are being copied unencrypted between accounts. Snapshot copy can apply required encryption controls. The present issue is a shared Linux filesystem must encrypt file data at rest; it is more directly addressed by Create encrypted Amazon EFS file systems using an approved KMS key. EFS encryption protects stored file data.

Create encrypted Amazon EFS file systems using an approved KMS key solves a different operational problem where a shared Linux filesystem must encrypt file data at rest. EFS encryption protects stored file data. It does not directly address eFS mounts must be restricted to authorized EC2 hosts and IAM callers. The case calls for Combine mount-target security groups, file-system policy and IAM authorization, since eFS network and resource permissions govern mount access.

The competing option Copy eligible snapshots with approved encryption and cross-account key permissions would be useful when application EBS snapshots are being copied unencrypted between accounts. Snapshot copy can apply required encryption controls. The present issue is eFS mounts must be restricted to authorized EC2 hosts and IAM callers; it is more directly addressed by Combine mount-target security groups, file-system policy and IAM authorization. EFS network and resource permissions govern mount access.

The option Use AWS Config encryption compliance rules and remediation workflows addresses a separate condition: a shared backup process needs to ensure no unencrypted EBS volumes remain. Config detection identifies noncompliant storage configurations. The actual requirement is eFS mounts must be restricted to authorized EC2 hosts and IAM callers. Recommended corrective action: Combine mount-target security groups, file-system policy and IAM authorization. EFS network and resource permissions govern mount access.

Create encrypted Amazon EFS file systems using an approved KMS key solves a different operational problem where a shared Linux filesystem must encrypt file data at rest. EFS encryption protects stored file data. It does not directly address application EBS snapshots are being copied unencrypted between accounts. The case calls for Copy eligible snapshots with approved encryption and cross-account key permissions, since snapshot copy can apply required encryption controls.

The competing option Use AWS Config encryption compliance rules and remediation workflows would be useful when a shared backup process needs to ensure no unencrypted EBS volumes remain. Config detection identifies noncompliant storage configurations. The present issue is application EBS snapshots are being copied unencrypted between accounts; it is more directly addressed by Copy eligible snapshots with approved encryption and cross-account key permissions. Snapshot copy can apply required encryption controls.

Combine mount-target security groups, file-system policy and IAM authorization would help if eFS mounts must be restricted to authorized EC2 hosts and IAM callers. EFS network and resource permissions govern mount access. That is not the symptom described here: application EBS snapshots are being copied unencrypted between accounts. The matching response is Copy eligible snapshots with approved encryption and cross-account key permissions, because snapshot copy can apply required encryption controls.

The competing option Copy eligible snapshots with approved encryption and cross-account key permissions would be useful when application EBS snapshots are being copied unencrypted between accounts. Snapshot copy can apply required encryption controls. The present issue is a database host needs block encryption for new attached EBS volumes; it is more directly addressed by Enable EBS encryption by default and use appropriate KMS keys. Account/region EBS defaults encrypt supported new volumes.

The option Combine mount-target security groups, file-system policy and IAM authorization addresses a separate condition: eFS mounts must be restricted to authorized EC2 hosts and IAM callers. EFS network and resource permissions govern mount access. The actual requirement is a database host needs block encryption for new attached EBS volumes. Recommended corrective action: Enable EBS encryption by default and use appropriate KMS keys. Account/region EBS defaults encrypt supported new volumes.

Use AWS Config encryption compliance rules and remediation workflows would help if a shared backup process needs to ensure no unencrypted EBS volumes remain. Config detection identifies noncompliant storage configurations. That is not the symptom described here: a database host needs block encryption for new attached EBS volumes. The matching response is Enable EBS encryption by default and use appropriate KMS keys, because account/region EBS defaults encrypt supported new volumes.

The option Create encrypted Amazon EFS file systems using an approved KMS key addresses a separate condition: a shared Linux filesystem must encrypt file data at rest. EFS encryption protects stored file data. The actual requirement is a shared backup process needs to ensure no unencrypted EBS volumes remain. Recommended corrective action: Use AWS Config encryption compliance rules and remediation workflows. Config detection identifies noncompliant storage configurations.

For the alternative failure a database host needs block encryption for new attached EBS volumes, the control Enable EBS encryption by default and use appropriate KMS keys is relevant: account/region EBS defaults encrypt supported new volumes. Here the evidence instead is a shared backup process needs to ensure no unencrypted EBS volumes remain. The selected technical mechanism is Use AWS Config encryption compliance rules and remediation workflows: config detection identifies noncompliant storage configurations.

Combine mount-target security groups, file-system policy and IAM authorization solves a different operational problem where eFS mounts must be restricted to authorized EC2 hosts and IAM callers. EFS network and resource permissions govern mount access. It does not directly address a shared backup process needs to ensure no unencrypted EBS volumes remain. The case calls for Use AWS Config encryption compliance rules and remediation workflows, since config detection identifies noncompliant storage configurations.

Configure replica key permissions separately for the regional consumer would help if a replica KMS key is created but its policy allows no application decrypt. Each regional key has independent access policy evaluation. That is not the symptom described here: customers in a secondary region cannot decrypt replicas encrypted with a single-region key. The matching response is Use a suitable regional key or supported KMS multi-Region key architecture, because kMS keys have regional scope unless using multi-Region key design.

Use SSE-KMS with a customer key when KMS policy control is required solves a different operational problem where an S3 object uses SSE-S3 and the team expects KMS key-policy enforcement. SSE-S3 encryption is not controlled by customer KMS key policies. It does not directly address customers in a secondary region cannot decrypt replicas encrypted with a single-region key. The case calls for Use a suitable regional key or supported KMS multi-Region key architecture, since kMS keys have regional scope unless using multi-Region key design.

The competing option Permit the replication role necessary KMS decrypt and encrypt operations would be useful when s3 replication attempts to use a source key unavailable to its replication role. Replication requires access to both source and destination encryption keys. The present issue is customers in a secondary region cannot decrypt replicas encrypted with a single-region key; it is more directly addressed by Use a suitable regional key or supported KMS multi-Region key architecture. KMS keys have regional scope unless using multi-Region key design.

For the alternative failure an S3 object uses SSE-S3 and the team expects KMS key-policy enforcement, the control Use SSE-KMS with a customer key when KMS policy control is required is relevant: sSE-S3 encryption is not controlled by customer KMS key policies. Here the evidence instead is a replica KMS key is created but its policy allows no application decrypt. The selected technical mechanism is Configure replica key permissions separately for the regional consumer: each regional key has independent access policy evaluation.

Specify a full key ARN for sensitive cross-account encryption operations solves a different operational problem where client requests use a KMS alias name that resolves to an unintended account key. Aliases can resolve in the requester's account context. It does not directly address a replica KMS key is created but its policy allows no application decrypt. The case calls for Configure replica key permissions separately for the regional consumer, since each regional key has independent access policy evaluation.

The option Permit the replication role necessary KMS decrypt and encrypt operations addresses a separate condition: s3 replication attempts to use a source key unavailable to its replication role. Replication requires access to both source and destination encryption keys. The actual requirement is a replica KMS key is created but its policy allows no application decrypt. Recommended corrective action: Configure replica key permissions separately for the regional consumer. Each regional key has independent access policy evaluation.

Use SSE-KMS with a customer key when KMS policy control is required solves a different operational problem where an S3 object uses SSE-S3 and the team expects KMS key-policy enforcement. SSE-S3 encryption is not controlled by customer KMS key policies. It does not directly address s3 replication attempts to use a source key unavailable to its replication role. The case calls for Permit the replication role necessary KMS decrypt and encrypt operations, since replication requires access to both source and destination encryption keys.

The competing option Configure replica key permissions separately for the regional consumer would be useful when a replica KMS key is created but its policy allows no application decrypt. Each regional key has independent access policy evaluation. The present issue is s3 replication attempts to use a source key unavailable to its replication role; it is more directly addressed by Permit the replication role necessary KMS decrypt and encrypt operations. Replication requires access to both source and destination encryption keys.

Use a suitable regional key or supported KMS multi-Region key architecture would help if customers in a secondary region cannot decrypt replicas encrypted with a single-region key. KMS keys have regional scope unless using multi-Region key design. That is not the symptom described here: s3 replication attempts to use a source key unavailable to its replication role. The matching response is Permit the replication role necessary KMS decrypt and encrypt operations, because replication requires access to both source and destination encryption keys.

The competing option Use a suitable regional key or supported KMS multi-Region key architecture would be useful when customers in a secondary region cannot decrypt replicas encrypted with a single-region key. KMS keys have regional scope unless using multi-Region key design. The present issue is client requests use a KMS alias name that resolves to an unintended account key; it is more directly addressed by Specify a full key ARN for sensitive cross-account encryption operations. Aliases can resolve in the requester's account context.

Permit the replication role necessary KMS decrypt and encrypt operations would help if s3 replication attempts to use a source key unavailable to its replication role. Replication requires access to both source and destination encryption keys. That is not the symptom described here: client requests use a KMS alias name that resolves to an unintended account key. The matching response is Specify a full key ARN for sensitive cross-account encryption operations, because aliases can resolve in the requester's account context.

For the alternative failure an S3 object uses SSE-S3 and the team expects KMS key-policy enforcement, the control Use SSE-KMS with a customer key when KMS policy control is required is relevant: sSE-S3 encryption is not controlled by customer KMS key policies. Here the evidence instead is client requests use a KMS alias name that resolves to an unintended account key. The selected technical mechanism is Specify a full key ARN for sensitive cross-account encryption operations: aliases can resolve in the requester's account context.

The option Use a suitable regional key or supported KMS multi-Region key architecture addresses a separate condition: customers in a secondary region cannot decrypt replicas encrypted with a single-region key. KMS keys have regional scope unless using multi-Region key design. The actual requirement is an S3 object uses SSE-S3 and the team expects KMS key-policy enforcement. Recommended corrective action: Use SSE-KMS with a customer key when KMS policy control is required. SSE-S3 encryption is not controlled by customer KMS key policies.

Configure replica key permissions separately for the regional consumer would help if a replica KMS key is created but its policy allows no application decrypt. Each regional key has independent access policy evaluation. That is not the symptom described here: an S3 object uses SSE-S3 and the team expects KMS key-policy enforcement. The matching response is Use SSE-KMS with a customer key when KMS policy control is required, because sSE-S3 encryption is not controlled by customer KMS key policies.

For the alternative failure s3 replication attempts to use a source key unavailable to its replication role, the control Permit the replication role necessary KMS decrypt and encrypt operations is relevant: replication requires access to both source and destination encryption keys. Here the evidence instead is an S3 object uses SSE-S3 and the team expects KMS key-policy enforcement. The selected technical mechanism is Use SSE-KMS with a customer key when KMS policy control is required: sSE-S3 encryption is not controlled by customer KMS key policies.