Question

A media company must store highly sensitive video masters in Amazon S3. Corporate policy mandates that AWS never stores or manages the encryption keys in any form, and that the company retains full possession of the key material outside of AWS. The application layer already has secure logic to hold and supply keys on every request. Which S3 encryption approach meets these requirements?

Accepted Answer

Use server-side encryption with customer-provided keys (SSE-C), supplying the encryption key with each PUT and GET request over HTTPS.

Answer

Use server-side encryption with an AWS KMS customer managed key (SSE-KMS) and disable automatic key rotation.

Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3) and enable an S3 bucket policy requiring TLS.

Answer

Import your own key material into AWS KMS and use that key for SSE-KMS encryption of the bucket.