A company has an encrypted Amazon Redshift cluster. The company recently enabled Amazon Redshift audit logs and needs to ensure that the audit logs are also encrypted at rest. The logs are retained…

Question

Options

• AEncrypt the Amazon S3 bucket where the logs are stored by using AWS Key Management
• BDisable encryption on the Amazon Redshift cluster, configure audit logging, and encrypt the
• CEnable default encryption on the Amazon S3 bucket where the logs are stored by using AES-256
• DEnable default encryption on the Amazon S3 bucket where the logs are stored by using AES-256

• A
  17% (5)
• B
  3% (1)
• C
  10% (3)
• D
  70% (21)

Explanation

The most cost-effective approach is to enable default SSE-S3 (AES-256) encryption on the S3 bucket where audit logs are stored, combined with an S3 storage class transition to S3 Glacier or S3 Intelligent-Tiering to optimize for infrequent access (once per month) over 1 year. SSE-S3 encryption is free - there are no additional API charges or KMS key management fees, unlike AWS KMS (SSE-KMS), which charges per API call for encrypt/decrypt operations. Since auditors query logs only once a month, transitioning to a cheaper storage tier (Glacier or Intelligent-Tiering) significantly reduces storage costs versus Standard S3. Option A (KMS) provides encryption but incurs per-request KMS API charges that add up over a year of stored logs. Options B and C are either operationally disruptive or incomplete.

No community discussion yet for this question.