CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding Encryption Options for S3: A Walkthrough
Explore the intricacies of AWS S3 encryption options and ensure you ace your SAA-C03 exam with this detailed question breakdown.
Choosing the right encryption method for S3 can trip up many candidates. The requirements for auditing and key rotation add complexity. Let's break down a specific question to clarify these concepts.
The question
A security team requires that all objects in an S3 bucket are encrypted at rest using keys that can be audited and rotated, with access logged in CloudTrail. Which option meets this requirement?
A. SSE-S3 (Amazon S3 managed keys)
B. Client-side encryption with a hardcoded key
C. SSE-KMS with a customer managed key
D. No encryption; rely on bucket policy
Think before you scroll
Consider the requirements of encryption at rest, auditability of keys, and the need for key rotation. Each option offers different levels of compliance with these needs.
The answer
The correct option is C. SSE-KMS with a customer managed key. This choice provides auditable key usage in CloudTrail and allows for key rotation. It also offers fine-grained access control through key policies.
Why the other options lose
- A. SSE-S3 (Amazon S3 managed keys): While SSE-S3 encrypts data at rest, it does not provide the same level of auditing and control as SSE-KMS. You cannot manage keys or rotate them effectively, which fails the requirement for auditing.
- B. Client-side encryption with a hardcoded key: This option lacks auditing capabilities and is prone to security risks. Hardcoding keys is not a best practice and does not meet the requirement for key rotation or access logging.
- D. No encryption; rely on bucket policy: This option does not provide encryption at rest, which is a fundamental requirement of the question. A bucket policy alone cannot meet the security team's needs for auditing and key management.
The concept behind it
The key principle here is understanding AWS encryption options and their capabilities. When dealing with sensitive data, always prioritize solutions that offer auditing, key management, and compliance with security policies. SSE-KMS stands out for its ability to provide all three aspects effectively.
Exam trap to remember
Remember: If encryption is required, always consider options that provide key management and auditing. This will help you avoid common pitfalls in the exam.