Question

A healthcare company must store protected health information (PHI) in an S3 bucket. Their compliance framework requires that all object data be encrypted at rest with two independent layers of encryption applied server-side, and that the encryption be managed through AWS KMS with full CloudTrail auditability of key usage. Which S3 default encryption configuration meets these requirements with the least operational overhead?

Accepted Answer

Configure the bucket default encryption to use DSSE-KMS (dual-layer server-side encryption with AWS KMS keys).

Answer

Configure the bucket default encryption to use SSE-S3 (Amazon S3-managed keys).

Answer

Configure the bucket default encryption to use SSE-KMS with an S3 Bucket Key enabled.

Answer

Require clients to use SSE-C and additionally enable SSE-KMS as the bucket default.