AWS Certified Solutions Architect – Associate (SAA-C03)Design Secure ArchitecturesMedium
A global media company uses Amazon S3 to store large volumes of video and image assets. Due to regulatory requirements, all data must be encrypted at rest, and the encryption keys must be managed by AWS KMS. The company also needs to ensure that access to these keys is auditable. Which S3 encryption option should they choose?
- AServer-Side Encryption with Customer-Provided Keys (SSE-C)
- BClient-Side Encryption with a customer master key (CMK) stored in AWS KMS
- CServer-Side Encryption with Amazon S3-Managed Keys (SSE-S3)
- DServer-Side Encryption with AWS Key Management Service (SSE-KMS)
Show answer & explanationAnswer & explanation
Correct answer: D. Server-Side Encryption with AWS Key Management Service (SSE-KMS)
SSE-KMS allows S3 objects to be encrypted using customer master keys (CMKs) from AWS KMS. This option meets the requirement for AWS KMS-managed keys and provides an audit trail of key usage through AWS CloudTrail, which is crucial for regulatory compliance.
Why the other options are wrong
- A. SSE-C requires the customer to provide and manage their own encryption keys, which are not managed by AWS KMS, and key usage is not auditable via AWS KMS.
- B. While client-side encryption with KMS CMKs is a valid encryption method, the question specifically asks for an 'S3 encryption option' for at-rest encryption within S3 that uses KMS-managed keys, which SSE-KMS provides for server-side encryption.
- C. SSE-S3 uses keys managed entirely by AWS, not AWS KMS-managed keys, and does not provide an auditable trail of key usage by the customer.
SSE-KMS
Server-Side Encryption with AWS Key Management Service (SSE-KMS) allows S3 objects to be encrypted using customer master keys (CMKs) stored and managed in AWS KMS.
- Uses AWS KMS to manage encryption keys (CMKs).
- Provides an audit trail of key usage through AWS CloudTrail.
- Offers more control over key rotation and permissions than SSE-S3.
Memory trick: KMS Keys Keep S3 Secure and Auditable.