S3 Quiz
Your company is planning to store sensitive documents in a bucket in the Simple Storage service. They need to ensure that all objects are encrypted at rest in the bucket. Which of the following can help accomplish this? Choose 2 answers from the options given below
A. Ensure that the default encryption is enabled for the S3 bucket
B. Ensure that the bucket policy is set to encrypt all objects that are added to the bucket
C. Ensure that the bucket ACL is set to encrypt all objects that are added to the bucket
D. Ensure to change the configuration of the bucket to use a KMS key to encrypt the objects
A. & D.
Options B and C are incorrect since these options cannot be used to actually encrypt the objects
The AWS Documentation mentions the following
You have three mutually exclusive options depending on how you choose to manage the encryption keys:
– Use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) – Each object is encrypted with a unique key employing strong multi-factor encryption. As an additional safeguard, it encrypts the key itself with a master key that it regularly rotates..
– Use Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) – Similar to SSE-S3, but with some additional benefits along with some additional charges for using this service. There are separate permissions for the use of an envelope key (that is, a key that protects your data’s encryption key) that provides added protection against unauthorized access of your objects in S3.
– Use Server-Side Encryption with Customer-Provided Keys (SSE-C) – You manage the encryption keys and Amazon S3 manages the encryption, as it writes to disks, and decryption, when you access your objects.
For more information on Server – Side encryption, please refer to the below URL
https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html
