Encrypt sensitive S3 data with a KMS key managed by the customer.
Audit key use and separate key permissions from bucket access.
Which setting is most appropriate?
Use SSE-KMS and specify the customer managed KMS key for S3 server-side encryption.
Detailed explanation
SSE-KMS encrypts objects with the selected KMS key and enables KMS authorization and audit controls.
SSE-KMS encrypts objects with the selected KMS key and enables KMS authorization and audit controls.
Preventing public access is separate from encrypting stored data.
Preventing public access is separate from encrypting stored data.
DNSSEC protects DNS responses and does not encrypt S3 objects.
DNSSEC protects DNS responses and does not encrypt S3 objects.
SSE-S3 can encrypt data but does not satisfy the customer managed key requirement.
SSE-S3 can encrypt data but does not satisfy the customer managed key requirement.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 SSE-KMSの公式説明を確認する。
What to confirm
SSE-S3、SSE-KMS、公開アクセス制御の違いを説明できる。
Key points
- SSE-KMS
- Customer managed KMS key
- S3 encryption
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Encryption versus access block
Encryption protects data content; Block Public Access controls exposure paths.
Key authorization
SSE-KMS adds KMS permissions and key-use audit events to the S3 request.