DVA-C02 Question 171
Select 2You are developing a serverless application that stores sensitive customer data in an Amazon S3 bucket. The application uses Amazon API Gateway to handle client requests and invokes AWS Lambda functions to process the data. To ensure compliance with security requirements, you need to implement encryption both at rest and in transit. Which of the following actions should you take to meet these requirements?
- A
Enable server-side encryption (SSE) on the S3 bucket using AWS Key Management Service (AWS KMS).
- B
Configure the API Gateway to use an HTTPS endpoint with an SSL/TLS certificate.
- C
Use client-side encryption to encrypt data before sending it to the S3 bucket.
- D
Ensure the Lambda function only communicates with the S3 bucket over HTTP to reduce latency.
- E
Enable S3 Transfer Acceleration to enhance data transmission security.
Show answer and explanation
Correct answers: A, B
Explanation
To ensure encryption at rest, you must enable server-side encryption (SSE) on the S3 bucket, which can use AWS KMS. For encryption in transit, you must configure API Gateway to use HTTPS, which secures data transfer. Other options like client-side encryption or using HTTP instead of HTTPS do not address the requirements effectively, and S3 Transfer Acceleration is unrelated to encryption.
- A. Correct.
Correct: Enabling server-side encryption (SSE) with AWS KMS ensures encryption at rest for data stored in the S3 bucket.
- B. Correct.
Correct: Configuring the API Gateway to use HTTPS ensures encryption in transit by securing data transmission between the client and the API Gateway.
- C. Incorrect.
Incorrect: While client-side encryption is an option, it is not required if server-side encryption and HTTPS are properly configured. Additionally, this would add unnecessary complexity to the solution.
- D. Incorrect.
Incorrect: Using HTTP instead of HTTPS for communication would compromise the encryption in transit and violate security compliance requirements.
- E. Incorrect.
Incorrect: S3 Transfer Acceleration is designed to speed up data transfers to and from S3, but it does not inherently enhance data security or encryption.