SAA-C03 Question 84
Single answerA financial services company uses Amazon S3 to store sensitive customer data. They want to ensure that all data is encrypted at rest and that they comply with stringent regulatory requirements for key management by maintaining full control over encryption keys. Which solution should they implement?
- A
Use S3 Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)
- B
Use S3 Server-Side Encryption with AWS Key Management Service (SSE-KMS) and AWS-managed keys
- C
Use S3 Server-Side Encryption with AWS Key Management Service (SSE-KMS) and customer-managed keys
- D
Use Client-Side Encryption with keys managed in-house
Show answer and explanation
Correct answer: C
Explanation
The company needs a solution that ensures encryption at rest and gives them full control over the encryption keys to comply with regulations. S3 Server-Side Encryption with AWS Key Management Service (SSE-KMS) and customer-managed keys meets these requirements by allowing the company to manage their own keys while leveraging AWS KMS for secure key storage, rotation, and auditing.
- A. Incorrect.
S3 Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) encrypts data at rest, but the encryption keys are fully managed by AWS. This does not give the company full control over the keys, which is required to meet their regulatory needs.
- B. Incorrect.
S3 Server-Side Encryption with AWS Key Management Service (SSE-KMS) and AWS-managed keys provides a higher level of control than SSE-S3, but the keys are still managed by AWS, not the customer, which does not satisfy the requirement for full control over the keys.
- C. Correct.
S3 Server-Side Encryption with AWS Key Management Service (SSE-KMS) and customer-managed keys allows the company to create and manage their own keys in AWS KMS. This solution satisfies both the encryption requirement and the need for full control over the keys, making it compliant with stringent regulatory requirements.
- D. Incorrect.
Client-Side Encryption with keys managed in-house could provide full control over the keys, but it introduces significant complexity in managing encryption, key rotation, and access policies. Additionally, this approach may not integrate well with Amazon S3's native features for encryption and key management.