SAA-C03 · Question #713
A healthcare company needs to encrypt patient data that is stored in an Amazon RDS for PostgreSQL DB instance to comply with regulations. The company must ensure that only specific IAM roles can…
The correct answer is B. Enable RDS encryption with a customer-managed AWS KMS key. Configure a key policy that. Amazon RDS encryption at rest for PostgreSQL is integrated with AWS Key Management Service. Using a customer-managed KMS key allows the company to define a key policy that explicitly limits key administration (management actions) and key usage (decrypt/encrypt actions) to only…
Question
A healthcare company needs to encrypt patient data that is stored in an Amazon RDS for PostgreSQL DB instance to comply with regulations. The company must ensure that only specific IAM roles can manage the encryption keys and decrypt the data. Which solution will meet these requirements with the LEAST operational overhead?
Options
- AEnable RDS encryption with AWS managed keys (aws/rds). Update the DB instance to restrict
- BEnable RDS encryption with a customer-managed AWS KMS key. Configure a key policy that
- CCreate a custom encryption method at the application layer. Store the encryption keys in an
- DEnable RDS encryption at rest with the default AWS KMS key. Control access to the RDS DB
How the community answered
(29 responses)- A3% (1)
- B83% (24)
- C10% (3)
- D3% (1)
Explanation
Amazon RDS encryption at rest for PostgreSQL is integrated with AWS Key Management Service. Using a customer-managed KMS key allows the company to define a key policy that explicitly limits key administration (management actions) and key usage (decrypt/encrypt actions) to only the required IAM roles, meeting the requirement for controlled key management and decryption with minimal operational effort.
Community Discussion
No community discussion yet for this question.