DVA-C02 Question 164
Single answerYou are developing a serverless application using AWS Lambda, and your function processes sensitive data that must be encrypted at rest. You want to ensure the data is encrypted before storing it in an Amazon S3 bucket. Which of the following approaches should you implement to meet the encryption requirement?
- A
Enable default server-side encryption (SSE-S3) on the S3 bucket.
- B
Use AWS KMS to encrypt the data within the Lambda function and store the encrypted data in the S3 bucket.
- C
Use client-side encryption with a custom encryption library before uploading the data to the S3 bucket.
- D
Enable S3 bucket policies to force encryption during data uploads.
Show answer and explanation
Correct answer: B
Explanation
AWS KMS provides a secure and managed way to handle encryption and key management. By using AWS KMS within the Lambda function to encrypt data before uploading it to the S3 bucket, you ensure that the sensitive data is encrypted at rest and meet the requirement of encrypting data before storage. This approach is preferred over SSE-S3 or bucket policies since they handle encryption only after the data is uploaded.
- A. Incorrect.
Enabling SSE-S3 ensures that data is encrypted at rest using AES-256, but this does not encrypt the data before it is uploaded to S3. The encryption process happens on the server-side, which does not meet the requirement of encrypting the data before storage.
- B. Correct.
Using AWS KMS to encrypt the data within the Lambda function ensures that the data is encrypted before it is uploaded to the S3 bucket, fulfilling the requirement of pre-storage encryption. This is the most secure and appropriate approach in this scenario.
- C. Incorrect.
Using a custom encryption library for client-side encryption is technically possible, but it requires additional implementation effort, and managing encryption keys securely becomes the developer's responsibility. AWS KMS provides a more secure and managed solution.
- D. Incorrect.
Enabling S3 bucket policies to enforce encryption only ensures that objects stored in the bucket are encrypted using server-side encryption methods like SSE-S3 or SSE-KMS. It does not handle encrypting data before it is uploaded.