A company is preparing to store confidential data in Amazon S3. For compliance reasons, the data must be encrypted at rest. Encryption key usage must be logged for auditing purposes. Keys must be rota

Question

Options

• AServer-side encryption with customer-provided keys (SSE-C)
• BServer-side encryption with Amazon S3 managed keys (SSE-S3)
• CServer-side encryption with AWS KMS keys (SSE-KMS) with manual rotation
• DServer-side encryption with AWS KMS keys (SSE-KMS) with automatic rotation

• A
  10% (5)
• B
  6% (3)
• C
  22% (11)
• D
  62% (31)

Explanation

SSE-KMS: Server-side encryption with AWS Key Management Service (SSE-KMS) provides robust encryption of data at rest, integrated with AWS KMS for key management and auditing. Automatic Key Rotation: By enabling automatic rotation for the KMS keys, the system ensures that keys are rotated annually without manual intervention, meeting compliance requirements. Logging and Auditing: AWS KMS automatically logs all key usage and management actions in AWS CloudTrail, providing the necessary audit logs. Create a KMS key with automatic rotation enabled. Configure the S3 bucket to use SSE-KMS with the created KMS key. Ensure CloudTrail is enabled for logging KMS key usage. Operational Efficiency: This solution provides encryption, automatic key management, and auditing in a seamless, fully managed way, reducing operational overhead.

No community discussion yet for this question.