Question

A healthcare company stores patient records as objects in an Amazon S3 bucket. Compliance requires that every object be encrypted at rest using a customer managed KMS key, and that the security team be able to audit and control which principals can decrypt the data. The team wants to guarantee that any object uploaded — regardless of whether the client specified encryption headers — is automatically encrypted with the correct key. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Enable default bucket encryption with SSE-KMS referencing the customer managed key, and manage decrypt permissions through the KMS key policy.

Answer

Rely on SSE-S3 default encryption and grant the security team read access to the bucket through an S3 bucket policy.

Answer

Require clients to send the x-amz-server-side-encryption header on every PutObject request and reject uploads with a Lambda function if the header is missing.

Answer

Enable client-side encryption in the application code using a KMS data key, and store the encrypted objects with no server-side encryption configured.