AWS Certified Data Analytics Specialty 2021 – Hands-On - S3 Default Encryption Versus and Bucket Policies

The video tutorial explains the differences between default encryption options and bucket policies in Amazon. It details how bucket policies can enforce encryption by refusing API calls without specified encryption headers, such as AES 256. The tutorial also covers the default encryption option in Amazon, which encrypts objects after upload if they are unencrypted. It emphasizes that bucket policies are evaluated before default encryption, meaning unencrypted objects will be denied if both are set. The lecture concludes with a brief wrap-up.

What is the primary function of a bucket policy in Amazon S3?

• To automatically encrypt all objects after upload

• To refuse API calls that do not meet specified conditions

• To increase the storage capacity of the bucket

• To provide a backup for all bucket data

Which encryption method is enforced by the bucket policy in the example given?

• Blowfish

• AES 128

• RSA 2048

• AES 256

How does default encryption in Amazon S3 differ from bucket policies?

• It requires manual activation for each object

• It denies all unencrypted uploads

• It encrypts objects after they are uploaded if they are not already encrypted

• It encrypts objects before they are uploaded

In what order are bucket policies and default encryption evaluated?

• Default encryption is evaluated before bucket policies

• The order depends on the size of the object

• Bucket policies are evaluated before default encryption

• They are evaluated simultaneously

What happens if both a bucket policy and default encryption are set, and an unencrypted object is uploaded?

• The object is encrypted twice

• The object is encrypted by default encryption

• The upload is denied by the bucket policy

• The object is uploaded without encryption