Question

A media company must encrypt very large video files (several GB each) on-premises before uploading them to Amazon S3. Compliance requires that the plaintext data key never leave the application and that encryption happen entirely client-side using a customer managed KMS key. The team wants to avoid sending the multi-GB payloads to KMS. Which approach correctly meets these requirements?

Accepted Answer

Use the AWS Encryption SDK, which calls KMS GenerateDataKey to obtain a plaintext and encrypted data key, encrypts the file locally with the plaintext key, then discards the plaintext key and stores the encrypted data key with the ciphertext.

Answer

Call the KMS Encrypt API directly with the full video file as the plaintext parameter, using the customer managed key.

Answer

Enable S3 default encryption with SSE-KMS on the bucket so the objects are encrypted with the customer managed key after upload.

Answer

Use SSE-C by generating a 256-bit key in the application and passing it in the request headers on each S3 PutObject call.