Sensitive data is stored in S3.
The operator must audit and disable key use and manage the KMS policy rather than rely on an AWS-owned key.
Which protection approach is most appropriate?
Use S3 SSE-KMS with a customer managed KMS key and align key, bucket, and IAM policies.
Detailed explanation
Bucket permissions alone do not protect data at rest.
Bucket permissions alone do not protect data at rest.
S3 encryption and key-use auditing are managed separately from data access.
S3 encryption and key-use auditing are managed separately from data access.
CloudTrail records API activity and does not encrypt stored objects.
CloudTrail records API activity and does not encrypt stored objects.
An unpredictable name is not encryption.
An unpredictable name is not encryption.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 SSE-KMS、AWS KMS customer managed key、bucket keyの公式説明を確認する。
What to confirm
SSE-KMSと暗号化なし・名前秘匿・CloudTrailの役割を区別できる。
Key points
- SSE-KMS
- Customer managed key
- kms:Decrypt
- S3
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Key separation
Separate key administration from data use and plan disable or deletion impact.
Cost
S3 Bucket Key can reduce KMS request volume for suitable workloads.