SOA-C02 Question 209
Single answerYou are managing an Amazon S3 bucket that stores sensitive customer data. Your compliance team requires that the data be encrypted at rest using a customer-managed key. How can you implement this encryption to meet the requirement?
- A
Enable default server-side encryption (SSE-S3) on the S3 bucket.
- B
Configure server-side encryption with AWS KMS (SSE-KMS) and specify a customer-managed key for encryption.
- C
Manually encrypt the objects using a client-side encryption library before uploading them to the S3 bucket.
- D
Use the S3 bucket policy to enforce object encryption using an AWS-managed key.
Show answer and explanation
Correct answer: B
Explanation
To meet the compliance requirement of encrypting data at rest with a customer-managed key, you must configure server-side encryption with AWS KMS (SSE-KMS) and specify a customer-managed key. This approach ensures that the encryption keys are under your control and comply with the compliance team's mandate.
- A. Incorrect.
This option uses the default S3-managed encryption keys (SSE-S3), which does not meet the requirement of using a customer-managed key.
- B. Correct.
This option meets the requirement because SSE-KMS allows you to specify a customer-managed key in AWS Key Management Service (KMS) for encrypting data at rest.
- C. Incorrect.
While client-side encryption allows encryption before uploading objects, it is not managed within AWS, making it harder to enforce compliance centrally.
- D. Incorrect.
This option enforces encryption, but an AWS-managed key does not satisfy the requirement for a customer-managed key.