Ensure Data Encryption in AWS S3 Bucket
Question
A company is using S3 to store data in the cloud, and they want to ensure that all the data in the bucket is encrypted.
Which option meets this requirement with the least overhead? (Select TWO.)
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Answer: B and D.
Option A is incorrect because S3 bucket encryption is not encrypted by default.
You need to use AWS SSE-S3 or KMS for its encryption.
Option B is CORRECT because encryption on S3 bucket objects can be completed using Server Side Encryption SSE-S3 with AES-256(Encryption type).
Option C is incorrect because Server Side Encryption should be used instead of Client-Side Encryption.
Option D is CORRECT because custom AWS KMS customer master key (CMK) provides encryption of S3 bucket objects and also allows managing the key policy and its rotation to the customer and satisfies the expectation as per the ask.
References:
For more information on AWS S3 Encryption options, refer to the URL provided below.
https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.htmlFor information on Custom AWS KMS Customer Master Key (CMK) and AWS Managed CMK, refer to the URL below:
https://aws.amazon.com/premiumsupport/knowledge-center/s3-object-encrpytion-keys/The two options that meet the requirement of encrypting all data in an S3 bucket with the least overhead are: A. All S3 data is encrypted by default, and B. Use AWS SSE-S3.
Option A. All S3 data is encrypted by default: Amazon S3 provides encryption of data at rest by default. When a user uploads an object to S3, Amazon S3 uses server-side encryption with encryption keys managed by Amazon S3 to encrypt the object data before saving it to disks in S3. Therefore, all objects stored in S3 buckets are encrypted by default. This option requires no additional setup or configuration, making it the most straightforward and easiest option for achieving data encryption in S3.
Option B. Use AWS SSE-S3: SSE-S3 stands for Server-Side Encryption with Amazon S3-managed keys. With this option, Amazon S3 manages the encryption keys, and encrypts data at rest automatically with AES-256 encryption. When a user uploads an object to S3, Amazon S3 encrypts the object using a unique key. This key is then encrypted with a master key that is regularly rotated by Amazon S3. This option requires no additional setup or configuration, making it the second easiest option for achieving data encryption in S3.
Option C. Enable AWS-KMS encryption and specify aws/s3 (AWS KMS-managed CMK) as the key for the Client-Side Encryption: Client-side encryption uses the AWS KMS encryption client library to encrypt the object before uploading it to S3. This option requires the user to enable AWS KMS encryption and specify aws/s3 (AWS KMS-managed CMK) as the key for client-side encryption. This option requires additional setup and configuration to achieve data encryption in S3.
Option D. Use Custom AWS KMS customer master key (CMK): Custom AWS KMS customer master key (CMK) is an option where the user manages the encryption keys used for server-side encryption. This option requires the user to create and manage a custom CMK in AWS KMS and then use it to encrypt the data. This option requires the most setup and configuration and is not the least overhead option.
In summary, the two options that meet the requirement of encrypting all data in an S3 bucket with the least overhead are: A. All S3 data is encrypted by default, and B. Use AWS SSE-S3.
