Customer data will be stored in Amazon S3.
The objects must be encrypted while held by the storage service.
Which control protects data at rest?
S3 server-side encryption, including SSE-KMS, protects objects stored by S3; the KMS key permissions must also be managed.
Detailed explanation
GuardDuty detects threats and does not define how S3 objects are encrypted at rest.
GuardDuty detects threats and does not define how S3 objects are encrypted at rest.
SSE-KMS encrypts S3 objects with an AWS KMS key and allows key usage to be controlled.
SSE-KMS encrypts S3 objects with an AWS KMS key and allows key usage to be controlled.
Route 53 provides DNS and does not encrypt objects stored in S3.
Route 53 provides DNS and does not encrypt objects stored in S3.
CloudTrail records audit events; it is not the storage-encryption control itself.
CloudTrail records audit events; it is not the storage-encryption control itself.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 User GuideのSSE-KMSとAWS KMSキーの説明を確認する。
What to confirm
S3オブジェクトの保存時にサーバー側暗号化とKMSキーを利用する。
Key points
- Data at rest
- Amazon S3
- SSE-KMS
Notes
- Environment: AWS公式S3・KMSドキュメントの確認
- Confirm current service capabilities and compliance guidance in the official AWS documentation.
Foundation review
Storage protection
S3 encryption protects objects while they are stored.
Key authorization
Using KMS also requires controlling which principals can use the key.