AWS Certified Solutions Architect Associate SAA-C03 Practice Question
A company has sensitive customer data that must be encrypted at rest in an Amazon S3 bucket. The company must also comply with regulatory requirements that mandate the periodic rotation of encryption keys. Which solution fulfills these requirements and is considered the BEST practice?
Implement Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) on the S3 bucket.
Enable Server-Side Encryption with AWS CloudHSM-Managed Keys on the S3 bucket.
Enable Server-Side Encryption with Customer-Provided Keys (SSE-C) on the S3 bucket and rotate the keys periodically with a custom solution.
Enable Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) on the S3 bucket and leverage automatic key rotation in AWS KMS.
Using AWS Key Management Service (AWS KMS) to manage encryption keys allows for both the necessary encryption of data at rest and the automated rotation of encryption keys. AWS KMS supports automatic key rotation, where a new version of the CMK is created every year, and previous versions of the key can still be used to decrypt data that was encrypted under it, thus maintaining access while adhering to the regulatory requirements. AWS CloudHSM is a service that helps you meet corporate, contractual, and regulatory compliance requirements for data security by using dedicated Hardware Security Module (HSM) appliances within the AWS Cloud, but it's not specified that dedicated HSMs are required. Using S3 managed keys (SSE-S3) does not provide the capability for manual key rotation or compliance with the specific mandate for key rotation. While Server-Side Encryption with Customer-Provided Keys (SSE-C) allows you to manage the encryption key, it does not provide any mechanisms for automated rotation.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is AWS KMS and how does it work?
Open an interactive chat with Bash
What are the differences between SSE-KMS and SSE-S3 in S3 encryption?