Question

A healthcare company stores patient datasets in an Amazon S3 bucket that will be used to train an Amazon SageMaker model. Compliance auditors require that the training data be encrypted at rest using keys the company can manage, rotate, and audit. Which approach meets this requirement with the least operational overhead?

Accepted Answer

Enable S3 server-side encryption with an AWS KMS customer managed key (SSE-KMS) on the bucket

Answer

Rely on the default Amazon S3 server-side encryption (SSE-S3) that AWS applies automatically

Answer

Encrypt the data client-side with a static password before uploading it to S3

Answer

Enable in-transit encryption by enforcing HTTPS on all S3 requests