Question

A media company must store highly sensitive raw footage in Amazon S3. Compliance requires that AWS never has access to the encryption key material and that the company supplies and manages the key bytes themselves for each PUT and GET request. The security team also wants to avoid managing any additional AWS-side key infrastructure. Which S3 encryption approach meets these requirements?

Accepted Answer

Use SSE-C (server-side encryption with customer-provided keys), supplying the key in each request while S3 performs encryption and decryption without storing the key

Answer

Use SSE-KMS with a customer managed KMS key and enable automatic annual key rotation

Answer

Use SSE-S3 with Amazon S3-managed keys and enforce a bucket policy requiring aws:SecureTransport

Answer

Use SSE-KMS with an imported key material KMS key so AWS holds only the wrapped copy