Question

A media company runs a data lake in a dedicated Data account within AWS Organizations. Analytics workloads in separate consumer accounts must read and process objects stored in a central S3 bucket. All objects must be encrypted at rest with a customer-managed key, key usage must be centrally auditable, and the security team requires that key material never be exposed and that individual consumer accounts can be revoked from decryption access without re-encrypting any data. Which approach best meets these requirements?

Accepted Answer

Create a customer-managed KMS key in the Data account, encrypt the bucket with SSE-KMS, and add the consumer account principals to the KMS key policy with kms:Decrypt; grant bucket access via bucket policy and control revocation by editing the key policy.

Answer

Encrypt objects with SSE-S3 in the Data account and grant consumer accounts read access to the bucket via a bucket policy; rely on S3 default encryption for auditability.

Answer

Distribute a copy of the KMS key material to each consumer account using imported key material so each account can decrypt objects locally without cross-account calls.

Answer

Encrypt objects client-side with a shared symmetric key stored in Secrets Manager and share the secret with each consumer account through resource-based policies.