Question

A security engineer is designing data protection for a new financial reporting application. Sensitive report files are uploaded by clients over the public internet to an Application Load Balancer, then processed by EC2 instances and stored in an Amazon S3 bucket and an Amazon RDS for PostgreSQL database. Compliance requires that data be protected both in transit and at rest, and that the organization retain full control over the cryptographic material used for encryption at rest. Which combination of controls satisfies these requirements with the least operational effort?

Accepted Answer

Terminate TLS at the ALB using an ACM public certificate, enforce HTTPS-only via a redirect listener, and use a customer managed AWS KMS key with automatic key rotation for SSE-KMS on S3 and RDS storage encryption.

Answer

Terminate TLS at the ALB using an ACM public certificate, and rely on SSE-S3 for the bucket and the default AWS managed KMS key (aws/rds) for the database to encrypt data at rest.

Answer

Use an AWS KMS asymmetric key to encrypt client uploads in transit, and enable SSE-KMS on S3 with the same asymmetric key while leaving RDS unencrypted since PostgreSQL uses TLS.

Answer

Import self-managed key material into AWS KMS with an annual expiration, disable automatic rotation, and manually re-import new key material each year to encrypt S3 and RDS data while terminating TLS at the EC2 instances.