Store model inputs, outputs, and customization data in S3.
Meet an organization's key-management and audit requirements.
Which design is appropriate?
Use managed key policies, access control, rotation, and audit for encryption keys; do not embed keys or grant universal access.
Detailed explanation
Data in transit also needs protection according to requirements.
Universal access defeats confidentiality.
Encryption must include control over who can use and administer the key.
A source leak exposes the key and prevents safe rotation.
Check official documentation
Compare the following points with the official documentation.
AWS KMS Developer GuideとAmazon S3の暗号化公式ドキュメントを確認する。
Official references
What to confirm
暗号化とキー管理を別の責任として、アクセス・監査・ローテーションを説明できる。
Key points
- KMS
- Key policy
- Audit
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Use versus administration
Permission to encrypt or decrypt is distinct from permission to change or delete a key.
Key lifecycle
Creation, access, rotation, disablement, audit, and deletion need coordinated controls.