SAA-C03 Question 86
Single answerA company stores sensitive customer data in an Amazon S3 bucket. The company requires that all data be encrypted at rest, and they must have full control over the encryption keys, including the ability to manage and rotate them. Which solution best meets these requirements?
- A
Use Amazon S3 server-side encryption with Amazon S3-managed keys (SSE-S3).
- B
Use Amazon S3 server-side encryption with AWS Key Management Service keys (SSE-KMS).
- C
Use Amazon S3 server-side encryption with customer-provided keys (SSE-C).
- D
Use client-side encryption with encryption keys managed locally by the company.
Show answer and explanation
Correct answer: D
Explanation
The company requires full control over encryption keys, including management and rotation, which is only possible with client-side encryption. This approach puts the responsibility for encryption and decryption entirely on the company, ensuring they retain full control over the keys. Other server-side encryption options, such as SSE-S3, SSE-KMS, and SSE-C, either rely on AWS-managed key infrastructure or do not provide full key management capabilities.
- A. Incorrect.
SSE-S3 encrypts data at rest, but the encryption keys are managed by AWS. The company does not have direct control over key management and rotation, which violates the requirements.
- B. Incorrect.
SSE-KMS provides encryption at rest and allows for some control over key management through AWS KMS, but AWS still manages the key infrastructure. This does not fully meet the requirement for complete control over keys.
- C. Incorrect.
SSE-C allows the company to supply their own encryption keys, but Amazon S3 does not store these keys. While this offers some control, it does not provide full key management capabilities such as rotation.
- D. Correct.
Client-side encryption ensures that data is encrypted before being uploaded to S3. The company manages the encryption keys locally, giving them full control over key management and rotation, which meets all the stated requirements.