CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Data Engineer - Associate (DEA-C01): Ensuring Data Encryption in S3
Master AWS encryption for sensitive data in S3. Learn the right services to use for encryption at rest and in transit.
When it comes to securing sensitive data in Amazon S3, many candidates stumble on the right combination of services. Understanding how to encrypt data both at rest and in transit is crucial for passing the AWS Certified Data Engineer - Associate exam.
The question
A data engineer is tasked with ensuring that sensitive data stored in Amazon S3 is encrypted both at rest and in transit. Which combination of services can the engineer use to achieve this?
- A. AWS Key Management Service (KMS) and Amazon CloudFront
- B. Amazon S3 Server-Side Encryption (SSE-KMS) and HTTPS
- C. AWS Secrets Manager and Amazon RDS
- D. Amazon S3 Object Lock and AWS Shield
Think before you scroll
Consider the requirements for encryption both at rest and in transit. Each option contains different services, but only one pair specifically addresses both encryption needs for Amazon S3 data.
The answer
The correct option is B: Amazon S3 Server-Side Encryption (SSE-KMS) and HTTPS. This combination ensures that sensitive data is encrypted while stored in S3 (at rest) and also while being transmitted over the network (in transit).
Why the other options lose
- A. AWS Key Management Service (KMS) and Amazon CloudFront: While KMS can handle encryption at rest, CloudFront is a content delivery network and does not provide the necessary data encryption for S3 in transit. Therefore, this option is incomplete.
- C. AWS Secrets Manager and Amazon RDS: This option focuses on managing secrets and relational database services, which do not relate to S3 encryption specifically. Thus, it fails to meet the data engineer's task.
- D. Amazon S3 Object Lock and AWS Shield: Object Lock is used for data retention and protection, while AWS Shield is a DDoS protection service. Neither provides encryption at rest or in transit for S3 data, making this option irrelevant.
The concept behind it
The principle here is clear: data must be encrypted both at rest and in transit to ensure comprehensive security. For Amazon S3, Server-Side Encryption (SSE) handles encryption at rest, while HTTPS secures data in transit. This knowledge can be applied to various AWS services that require similar security measures.
Exam trap to remember
Remember: to securely manage sensitive data, always consider the combination of encryption at rest and in transit. The right services must cover both aspects for full compliance.