These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-034
Audit requirements state that all access to a certain S3 bucket must occur over an encrypted communication path. Which method is the most appropriate for structurally rejecting unencrypted HTTP requests?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: B. Add a statement to the bucket policy that denies s3:* when the condition key aws:SecureTransport is false
Explanation
To enforce encryption in transit, explicitly deny requests where aws:SecureTransport is false in the bucket policy. Because an explicit Deny always takes precedence in IAM policy evaluation, HTTP access is always rejected regardless of any other allow.
Per-choice explanations
A. Enable SSE-S3 as the default encryption for the bucket
Incorrect. SSE-S3 encrypts data stored in S3 (at rest) and has nothing to do with the communication path between the client and S3. The requirement is encryption in transit, so it is not satisfied.
B. Add a statement to the bucket policy that denies s3:* when the condition key aws:SecureTransport is false
Correct. An explicit Deny takes precedence over any Allow, so HTTP requests are blocked structurally.
C. Enable all Block Public Access settings on the bucket
Incorrect. Block Public Access disables ACLs and bucket policies that would lead to public exposure; it does not evaluate whether the communication path is encrypted.
D. Issue a certificate with AWS Certificate Manager and assign it to the S3 bucket
Incorrect. You cannot assign an ACM certificate directly to an S3 bucket. If you need HTTPS delivery on a custom domain, you associate the ACM certificate with a CloudFront distribution.
Practical Use
S3 encryption has two axes, at rest and in transit, and they are configured in completely different places. At rest, you specify an encryption method such as SSE-S3, SSE-KMS, DSSE-KMS, or SSE-C through the bucket's default encryption or a request header. In transit, the question is whether TLS is used, and because S3 endpoints accept both HTTPS and HTTP by default, you need policy enforcement to prevent HTTP from being used. The mechanism for this enforcement is the AWS global condition context key aws:SecureTransport, which is true when the request arrives over TLS. The implementation is a bucket policy with Effect: Deny, Action: s3:*, Resource listing both the bucket ARN and the object ARN, and a Condition with Bool aws:SecureTransport false. Be careful to list both the bucket ARN (arn:aws:s3:::bucket) and the object ARN (arn:aws:s3:::bucket/*) in Resource; forgetting one lets operations such as ListBucket slip through. Because an explicit Deny takes precedence over every Allow in IAM policy evaluation, even an administrator in the same account is denied HTTP access. Similar condition-enforcement patterns include enforcing encryption at rest with s3:x-amz-server-side-encryption, and restricting access to a VPC endpoint with aws:SourceVpce. On SAA-C03, requirements such as "enforce encryption of data in transit" or "prohibit access over HTTP" make a Deny on aws:SecureTransport the correct answer. Distractors include default encryption (at rest), Block Public Access (public exposure control), and assigning an ACM certificate (not possible for S3 alone). Confusing at rest with in transit is the most common mistake in this area, so always read carefully which one the requirement is asking about.