SAA-C03 Question 85
Single answerA company is storing sensitive customer data in an Amazon S3 bucket. Compliance requirements mandate that the data must be encrypted at rest and that the encryption keys must be rotated automatically on a regular basis. Which solution will meet these requirements with the least operational overhead?
- A
Use S3 server-side encryption with Amazon S3-managed keys (SSE-S3).
- B
Use S3 server-side encryption with AWS Key Management Service (AWS KMS) keys (SSE-KMS).
- C
Use S3 server-side encryption with customer-provided keys (SSE-C).
- D
Enable client-side encryption and manage keys through an on-premises hardware security module (HSM).
Show answer and explanation
Correct answer: B
Explanation
The company needs a solution that ensures encryption at rest and supports automatic key rotation with minimal operational overhead. SSE-KMS leverages AWS Key Management Service (KMS) to manage encryption keys, providing features like automatic key rotation and centralized management, making it the best choice for this scenario.
- A. Incorrect.
SSE-S3 provides server-side encryption using keys managed by Amazon S3, but it does not support automatic key rotation or provide granular control over key management.
- B. Correct.
SSE-KMS integrates with AWS Key Management Service, which supports automatic key rotation and centralized key management, meeting the compliance requirements with minimal operational overhead.
- C. Incorrect.
SSE-C requires the customer to manage and provide their own encryption keys. This increases operational overhead and does not natively support automatic key rotation.
- D. Incorrect.
Client-side encryption managed through an on-premises HSM would meet encryption requirements, but it involves significant operational overhead and manual key rotation, making it less optimal.