S3 encryption: SAA-C03 study notes and practice questions
What to know about S3 encryption for the SAA-C03 exam, from the Design Secure Architectures domain (30% of the exam guide), then 1 free question to test it. Part of the SAA-C03 study guide.
Since January 2023, Amazon S3 encrypts every new object at rest by default with SSE-S3. So the exam rarely asks “how do I encrypt S3 data?”. It asks which kind of encryption meets a control requirement, and the answer depends on who must manage the key and who must be able to decrypt.
The options
Option
Who manages the key
Choose it when
SSE-S3
S3, fully
Encryption at rest is all that’s needed, at no extra cost
SSE-KMS with an AWS managed key (aws/s3)
AWS, in KMS
You want KMS logging in CloudTrail but no custom key policy
SSE-KMS with a customer managed key
You, in KMS
You need your own key policy, rotation control, cross-account use, or to stop administrators from decrypting
DSSE-KMS
You or AWS, in KMS
A rule specifically requires two layers of encryption at rest
SSE-C
You, outside AWS; you send the key with each request
You must hold the key yourself but want S3 to do the encryption
Client-side encryption
You, before upload
Data must never reach AWS unencrypted
Key facts
A customer managed key’s key policy is a separate gate. A user needs S3 permission andkms:Decrypt on the key. That is how you separate duties: S3 administrators can manage the bucket without being able to read the data.
S3 Bucket Keys reduce SSE-KMS request costs, often by up to 99%, by having S3 use a bucket-level data key instead of calling KMS for each object. Watch for a scenario with high KMS request costs or throttling.
Enforcing encryption: set the bucket’s default encryption to the key you want. A bucket policy can also deny PutObject requests that don’t use SSE-KMS or a specific key.
Encryption in transit: deny requests where aws:SecureTransport is false.
KMS keys are regional. Replicating encrypted objects to another Region needs a key in the destination Region set on the replication rule.
Common traps
Choosing SSE-S3 when the requirement says the company must control or audit the key. That needs SSE-KMS with a customer managed key.
Choosing SSE-C or client-side encryption for “least operational overhead”. Both make you manage keys yourself.
Forgetting the KMS permission. If a role can read the bucket but gets access denied on SSE-KMS objects, the fix is in the key policy or the role’s KMS permissions, not the bucket policy.
A healthcare company stores patient letters in an Amazon S3 bucket. Every object must be encrypted at rest.
The security team must be able to stop named administrators from decrypting the letters, even administrators who have full S3 permissions, by controlling who may use the encryption key. Key material must rotate automatically every year, and use of the key must be auditable in AWS CloudTrail.
The bucket receives about 2,000 uploads per second, and the company wants to keep AWS KMS request costs low.
Which solution meets these requirements?
Choose one answer.
AA. Set default encryption to SSE-KMS with the AWS managed key (aws/s3), and turn on S3 Bucket Keys for the bucket.
BB. Set default encryption to SSE-KMS with a customer managed key that has automatic rotation turned on, and turn on S3 Bucket Keys.
CC. Set default encryption to SSE-KMS with a customer managed key that has automatic rotation turned on, and leave Bucket Keys off.
DD. Set default encryption to SSE-S3, and add a bucket policy statement that denies s3:GetObject to the named administrators.
Show the answer and explanation
Answer: B
A. Wrong: AWS managed keys rotate every year, their use is logged in CloudTrail, and Bucket Keys would cut request costs. However, the key policy of an AWS managed key is controlled by the service and cannot be changed, so the security team cannot take decrypt rights away from particular administrators. A customer managed key gives that control. Learn more: AWS KMS keys (opens in a new tab)
B. Right: Correct. The company controls the key policy of a customer managed key, so it can deny key use to named administrators whatever their S3 permissions. Automatic rotation defaults to every 365 days, and key use appears in CloudTrail. S3 Bucket Keys can cut KMS request costs by up to 99 percent; CloudTrail then records fewer events, showing the bucket ARN rather than each object. Learn more: Rotate AWS KMS keys (opens in a new tab)
C. Wrong: This meets the control, rotation and audit requirements. Without Bucket Keys, though, S3 calls AWS KMS for each object it encrypts or decrypts, and at 2,000 uploads per second those requests add up to a large KMS bill. Turning on Bucket Keys keeps the same key and cuts the number of requests. Learn more: Reducing the cost of SSE-KMS with Amazon S3 Bucket Keys (opens in a new tab)
D. Wrong: SSE-S3 encrypts at rest with keys that Amazon S3 manages, so there is no key policy for the security team to control and no KMS key use to audit. A bucket policy deny is an S3 permission, and administrators with full S3 permissions could edit or remove it. SSE-KMS with a customer managed key separates key control from S3 access. Learn more: Protecting data with encryption in Amazon S3 (opens in a new tab)
Explanation
Two choices decide this: the key type and the Bucket Key setting. Only a customer managed key lets the company write its own key policy, which is how decrypt rights are taken away from administrators independently of S3 permissions; it also supports yearly automatic rotation and CloudTrail auditing. At thousands of requests per second, S3 Bucket Keys are what keep KMS request costs low.
Want more on S3 encryption? The 5 full-length practice sets have 10 more S3 encryption questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →