Question

A healthcare company stores patient training datasets in an S3 bucket that will be read by SageMaker training jobs. Compliance requires that all data at rest be encrypted with a customer-managed key so the security team can audit key usage and revoke access if needed. The ML engineer must ensure the training jobs can decrypt the objects while the security team retains full control over the key. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Enable SSE-KMS on the bucket using a customer-managed AWS KMS key, and grant the SageMaker execution role kms:Decrypt permission in the key policy.

Answer

Enable SSE-S3 (Amazon S3-managed keys) on the bucket so that objects are automatically encrypted without any key management.

Answer

Use client-side encryption, encrypting each object with a hardcoded key in the training script before upload and decrypting it after download.

Answer

Enable SSE-KMS with the AWS managed aws/s3 key and add the SageMaker execution role to the bucket policy.