DVA-C02 Question 163
Single answerA developer is building an application that stores sensitive customer data in an Amazon S3 bucket. To meet security requirements, the data must be encrypted at rest using a key managed and rotated by the organization. How can the developer implement this requirement using AWS services?
- A
Enable server-side encryption with Amazon S3-managed keys (SSE-S3) for the bucket.
- B
Use server-side encryption with AWS Key Management Service (SSE-KMS) and specify a customer-managed key (CMK).
- C
Encrypt the data on the client side before uploading it to the S3 bucket using a key stored in the application code.
- D
Enable server-side encryption with customer-provided keys (SSE-C) for the bucket.
Show answer and explanation
Correct answer: B
Explanation
To meet the requirement of encrypting data at rest with a key managed and rotated by the organization, the most suitable approach is to use SSE-KMS with a customer-managed key (CMK). This approach allows the organization to maintain control over the encryption key while benefiting from AWS Key Management Service (KMS) features such as automatic key rotation, auditing, and integration with other AWS services.
- A. Incorrect.
This option uses S3-managed keys, which are suitable for basic encryption needs but do not allow the organization to manage or rotate the keys. It does not meet the requirement to use a key managed by the organization.
- B. Correct.
This is the correct option. Server-side encryption with AWS Key Management Service (SSE-KMS) using a customer-managed key (CMK) allows the organization to manage and rotate the key, meeting the security requirements.
- C. Incorrect.
While client-side encryption could work, storing the encryption key in the application code is insecure and does not meet best practices for managing sensitive data.
- D. Incorrect.
Server-side encryption with customer-provided keys (SSE-C) requires the organization to manage the encryption keys externally. This introduces operational complexity and does not leverage AWS's key management capabilities, making it less suitable for this scenario.