Data at rest in S3 must use keys that you control. What do you configure?
Why A is the answer
SSE-KMS
SSE-KMS encrypts with keys in AWS KMS.
In detail
- SSE-KMS encrypts with KMS keys that you control.
- Key use is logged in CloudTrail.
Use case
An illustrative scenario, not a real incident.
A firm must control its keys, so S3 uses SSE-KMS with its own KMS key.
See it in different ways
flowchart TD A["Data protection"] --> B["At rest: KMS"] A --> C["In transit: TLS"] A --> D["For readers: masking"]
mindmap
root((Data security))
Identity
IAM roles
Secrets Manager
Fine-grained access
Lake Formation
Column grants
Encryption
SSE-KMS
Discovery
Macie
Audit
CloudTrailflowchart LR S0["Create KMS key"] --> S1["Set SSE-KMS"] --> S2["Objects encrypted"]
Key point: SSE-KMS uses keys in AWS KMS.
Why the other options are wrong
- B. SSE-S3
- SSE-S3 keys are managed by S3.
- C. S3 Transfer Acceleration
- That speeds uploads.
- D. Requester Pays
- That changes who pays.