Question

A data engineering team ingests customer records into an S3-based data lake. A compliance auditor requires that the data be protected both while moving between the on-premises source and AWS, and while stored in S3, using customer-managed keys where feasible. The team currently uploads files over the public internet using the AWS CLI with default S3 settings. Which combination of actions BEST satisfies both the in-transit and at-rest encryption requirements?

Accepted Answer

Enable S3 default encryption with SSE-KMS using a customer-managed CMK, and rely on HTTPS (TLS) endpoints for the CLI uploads to encrypt data in transit.

Answer

Enable S3 default encryption with SSE-S3, and add a bucket policy that denies any request where aws:SecureTransport is false.

Answer

Enable S3 Object Lock in compliance mode and use the CLI with default settings, since Object Lock encrypts data at rest and in transit.

Answer

Encrypt files locally with a static passphrase before upload and store them in an unencrypted S3 bucket accessed over HTTP.