A company plans to store sensitive user data on Amazon S3. Internal security compliance requirement mandate encryption of data before sending it to Amazon S3. What should a solutions architect recommend to satisfy these requirements?
A.
Server-side encryption with customer-provided encryption keys
B.
Client-side encryption with Amazon S3 managed encryption keys
C.
Server-side encryption with keys stored in AWS key Management Service (AWS KMS)
D.
Client-side encryption with a master key stored in AWS Key Management Service (AWS KMS)
Could it be also C, because as it is stated below, data is protected in transit and at rest?
Amazon S3 Encryption Client
Client-side encryption provides end-to-end protection for your object, in transit and at rest, from its source to storage in Amazon S3.
Your data is protected in transit and at rest. It is never exposed to any third party, including AWS.
You choose how your cryptographic keys are protected. You specify the wrapping key used to protect the data keys that encrypt your objects.
Your objects are all encrypted with a unique data key. The Amazon S3 Encryption Client does not use or interact with bucket keys, even if you specify a KMS key as your wrapping key.
https://docs.aws.amazon.com/amazon-s3-encryption-client/latest/developerguide/client-server-side.html
Answer D
Client-side encryption is the act of encrypting data before sending it to Amazon S3.
To enable client-side encryption, you have the following options:
Use a customer master key (CMK) stored in AWS Key Management Service (AWS KMS).
Use a master key that you store within your application.
Client side encryption has two options: 1. AWS KMS CMK 2. customer application
SSE-S3 is server side.
So there is no such thing called S3 client side encryption
https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html
A and C are eliminated; server-side encryption does not answer the qn of "mandate encryption of data before sending it to Amazon S3"
Between B and D, AWS key encryption is about KMS so D is the answer
Couldn't it be A because they havent migrated the data over yet, so they need to encrypt it before they send it over and so they'd have to do the encryption on prem?
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
yakman
Highly Voted 3 years, 9 months agorob_724
3 years, 9 months agoaguy9
3 years, 8 months agonoahsark
3 years, 7 months agoanpt
Highly Voted 3 years, 8 months agoEleftheriia
Most Recent 1 year, 4 months agoiamjeffbezos
2 years, 8 months ago17Master
2 years, 9 months agonaveenagurjara
2 years, 12 months agojasonzsg
3 years, 6 months agocvlaje
3 years, 7 months agochxzqw
3 years, 7 months agotinyshare
3 years, 7 months agosyu31svc
3 years, 7 months agomryala
3 years, 8 months agoYogi
3 years, 8 months agoKingshah23
3 years, 8 months agoKingshah23
3 years, 8 months agoashok1234567890
3 years, 8 months agoAnkitrathi85
3 years, 8 months agomyutran
3 years, 8 months agoAwsNewPeople
3 years, 8 months ago