Question

A healthcare application uploads patient documents to Amazon S3. Compliance rules require that the data must be encrypted before it leaves the application server, so that unencrypted content is never present anywhere in the AWS-managed storage layer, including S3 servers. The team also wants to manage the master key used for encryption. Which approach satisfies these requirements?

Accepted Answer

Use the AWS Encryption SDK (or S3 client-side encryption) with a KMS customer managed key to encrypt objects in the application before calling PutObject.

Answer

Enable SSE-S3 on the S3 bucket so that S3 automatically encrypts objects when they are written to disk.

Answer

Enable SSE-KMS with a customer managed key and enforce it with a bucket policy that denies unencrypted PutObject requests.

Answer

Upload objects over a TLS connection to guarantee the data is encrypted the entire time it is stored in S3.