Which combination of steps should the solutions architect take to meet these requirements?
(Choose two.)
Turn on server-side encryption on the SQS components. Update the default key policy to restrict key usage to a set of authorized principals.
Turn on server-side encryption on the SNS components by using an AWS Key Management Service (AWS KMS) customer managed key. Apply a key policy to restrict key usage to a set of authorized principals.
Turn on encryption on the SNS components. Update the default key policy to restrict key usage to a set of authorized principals. Set a condition in the topic policy to allow only encrypted connections over TLS.
Turn on server-side encryption on the SQS components by using an AWS Key Management Service (AWS KMS) customer managed key. Apply a key policy to restrict key usage to a set of authorized principals. Set a condition in the queue policy to allow only encrypted connections over TLS.
Turn on server-side encryption on the SQS components by using an AWS Key Management Service (AWS KMS) customer managed key. Apply an IAM policy to restrict key usage to a set of authorized principals. Set a condition in the queue policy to allow only encrypted connections over TLS.
Explanations:
While it’s correct to turn on server-side encryption for SQS, the question requires using an AWS KMS customer managed key. The answer refers to a default key, which does not fully meet the requirement of using a customer-managed key for encryption.
Turning on server-side encryption on SNS using an AWS KMS customer managed key ensures encryption at rest. Applying a key policy to restrict key usage to authorized principals helps enforce access control.
While this option talks about encryption on SNS, it does not mention using a customer managed key for encryption, which is necessary. Additionally, while it includes a topic policy to allow only encrypted connections, the question focuses on using KMS customer managed keys.
Turning on server-side encryption on SQS using an AWS KMS customer managed key ensures encryption at rest. Applying a key policy to restrict key usage and setting a condition to allow only encrypted connections over TLS adds a layer of security for both access and transmission.
While it’s correct to turn on server-side encryption on SQS using a customer-managed KMS key and apply restrictions, IAM policies are not the appropriate method for restricting key usage in this context. Key policies on the KMS key are the correct approach.
If memory serves me right, the answer is:
Turn on server-side encryption on the SNS components by using an AWS Key Management Service (AWS KMS) customer managed key. Apply a key policy to restrict key usage to a set of authorized principals.