The data owner must prevent S3 operators or cloud administrators from seeing plaintext.
Only approved recipients may decrypt the data.
Which protection approach is most appropriate?
Encrypt on the client before upload and manage the decryption keys on the data-owner side.
Detailed explanation
Plaintext is protected before it reaches the storage service.
Plaintext is protected before it reaches the storage service.
Name secrecy does not protect the content.
Name secrecy does not protect the content.
SSE responsibility and access depend on the service and permissions; it may not meet this boundary.
SSE responsibility and access depend on the service and permissions; it may not meet this boundary.
CloudTrail does not encrypt object bodies.
CloudTrail does not encrypt object bodies.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 client-side encryption、AWS Encryption SDK、KMS keyringの公式説明を確認する。
What to confirm
SSEとクライアント側暗号化の責任分界と適用要件を説明できる。
Key points
- Client-side encryption
- AWS Encryption SDK
- Key management
- Responsibility boundary
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Availability
Losing the client-side key can make data unrecoverable, so test backup and recovery.
Metadata
Avoid putting PII in object metadata or logs that remain outside the ciphertext.