KMS S3 Encryption Enforcement

Encrypting data at rest is a foundational security control, and the DevOps Engineer Professional exam expects you to combine KMS and S3 bucket policies to enforce encryption requirements.

In this lab you will act as a security engineer hardening an S3 bucket used by a production application. You will create a symmetric KMS key, configure default SSE-KMS encryption on a bucket, write a bucket policy that denies `s3:PutObject` unless the caller provides `x-amz-server-side-encryption: aws:kms` with the correct key, and then prove the enforcement works by uploading with and without encryption parameters.

You will:

• Create a symmetric KMS key with an alias and a custom key policy granting full access to the lab user and S3
• Create an S3 bucket with default SSE-KMS encryption using your key
• Author and apply a bucket policy that denies `s3:PutObject` unless the request includes the required KMS encryption headers
• Upload a file with `--sse aws:kms --sse-kms-key-id` (allowed) and without SSE parameters (denied with AccessDenied)
• List objects and verify their `SSEKMSKeyId` attribute, then clean up all resources