Exams / SAA-C03 / S3 encryption / Question 1
SAA-C03 practice question: S3 encryption
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A healthcare company stores patient letters in an Amazon S3 bucket. Every object must be encrypted at rest. The security team must be able to stop named administrators from decrypting the letters, even administrators who have full S3 permissions, by controlling who may use the encryption key. Key material must rotate automatically every year, and use of the key must be auditable in AWS CloudTrail. The bucket receives about 2,000 uploads per second, and the company wants to keep AWS KMS request costs low. Which solution meets these requirements?
Choose one answer.
- AA. Set default encryption to SSE-KMS with the AWS managed key (aws/s3), and turn on S3 Bucket Keys for the bucket.
- BB. Set default encryption to SSE-KMS with a customer managed key that has automatic rotation turned on, and turn on S3 Bucket Keys.
- CC. Set default encryption to SSE-KMS with a customer managed key that has automatic rotation turned on, and leave Bucket Keys off.
- DD. Set default encryption to SSE-S3, and add a bucket policy statement that denies s3:GetObject to the named administrators.
Show the answer and explanation
Answer: B
- A. Wrong: AWS managed keys rotate every year, their use is logged in CloudTrail, and Bucket Keys would cut request costs. However, the key policy of an AWS managed key is controlled by the service and cannot be changed, so the security team cannot take decrypt rights away from particular administrators. A customer managed key gives that control. Learn more: AWS KMS keys (opens in a new tab)
- B. Right: Correct. The company controls the key policy of a customer managed key, so it can deny key use to named administrators whatever their S3 permissions. Automatic rotation defaults to every 365 days, and key use appears in CloudTrail. S3 Bucket Keys can cut KMS request costs by up to 99 percent; CloudTrail then records fewer events, showing the bucket ARN rather than each object. Learn more: Rotate AWS KMS keys (opens in a new tab)
- C. Wrong: This meets the control, rotation and audit requirements. Without Bucket Keys, though, S3 calls AWS KMS for each object it encrypts or decrypts, and at 2,000 uploads per second those requests add up to a large KMS bill. Turning on Bucket Keys keeps the same key and cuts the number of requests. Learn more: Reducing the cost of SSE-KMS with Amazon S3 Bucket Keys (opens in a new tab)
- D. Wrong: SSE-S3 encrypts at rest with keys that Amazon S3 manages, so there is no key policy for the security team to control and no KMS key use to audit. A bucket policy deny is an S3 permission, and administrators with full S3 permissions could edit or remove it. SSE-KMS with a customer managed key separates key control from S3 access. Learn more: Protecting data with encryption in Amazon S3 (opens in a new tab)
Explanation
Two choices decide this: the key type and the Bucket Key setting. Only a customer managed key lets the company write its own key policy, which is how decrypt rights are taken away from administrators independently of S3 permissions; it also supports yearly automatic rotation and CloudTrail auditing. At thousands of requests per second, S3 Bucket Keys are what keep KMS request costs low.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.