Question

A developer is building a document storage feature that must upload objects to Amazon S3. Compliance requires that the organization supply and manage the encryption keys itself, and that AWS never store the keys. The keys are held in an on-premises hardware security module and provided at upload time. The developer wants the encryption/decryption to happen on the S3 server side without integrating with AWS KMS. Which approach meets these requirements?

Accepted Answer

Use server-side encryption with customer-provided keys (SSE-C), passing the key material in the request headers on each PUT and GET.

Answer

Use server-side encryption with AWS KMS keys (SSE-KMS) and import the on-premises key material into a customer managed key.

Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3) and rely on S3 to rotate the keys automatically.

Answer

Use client-side encryption with the AWS Encryption SDK before uploading the plaintext objects.