SAP-C02 Question 216
Select 2A financial services company needs to store sensitive customer data in Amazon S3. They must comply with regulatory requirements that mandate encryption of data at rest and the ability to manage encryption keys centrally. Additionally, they want to ensure that access to this data is restricted to specific roles within their organization. Which combination of security controls should be implemented to meet these requirements?
- A
Enable server-side encryption with AWS Key Management Service (SSE-KMS) and configure a custom key policy to define key access.
- B
Use S3 bucket policies to restrict access to specific IAM roles.
- C
Enable server-side encryption with Amazon S3-Managed Keys (SSE-S3) without additional configurations.
- D
Enable default bucket encryption and configure an S3 Access Point with VPC restrictions.
- E
Use client-side encryption and store keys in an external key management system outside of AWS.
Show answer and explanation
Correct answers: A, B
Explanation
The requirements specify encryption at rest, centralized key management, and restricting access to specific roles. SSE-KMS with a custom key policy fulfills the encryption and key management needs, while S3 bucket policies restrict access based on IAM roles. Together, these solutions meet all specified criteria while aligning with AWS best practices for security and compliance.
- A. Correct.
This is correct. SSE-KMS allows you to encrypt data at rest with the ability to centrally manage encryption keys using AWS Key Management Service. A custom key policy ensures that key access is tightly controlled, meeting the compliance and security requirements.
- B. Correct.
This is correct. S3 bucket policies can be used to restrict access to specific IAM roles, ensuring that only authorized roles can access the sensitive data.
- C. Incorrect.
This is incorrect. SSE-S3 provides encryption at rest, but it does not allow for centralized key management or fine-grained access controls, which are required by the scenario.
- D. Incorrect.
This is incorrect. While enabling default bucket encryption and using an S3 Access Point with VPC restrictions enhances security, it does not address the need for centralized key management or define access based on IAM roles.
- E. Incorrect.
This is incorrect. Client-side encryption with an external key management system outside AWS could work, but it introduces unnecessary complexity and does not leverage AWS-native solutions that meet the requirements more efficiently.