A company wants Amazon S3 to perform server-side encryption while the company supplies the encryption key with each object request and retains the key itself. Which option should it choose?
Show answer and explanation
Answer: C
SSE-C is the form of server-side encryption in which the customer transmits the raw encryption key with every S3 request: S3 uses it to encrypt or decrypt the object and then discards it without storing it. The key never leaves customer control, exactly matching the requirement.
SSE-S3 keeps the keys under S3 management, SSE-KMS stores keys in AWS KMS where KMS policies and auditing apply to every use, and client-side encryption means the data is already encrypted before S3 ever receives it, so it is not a server-side option at all.
Why the other options are wrong
- A. With SSE-S3, AWS manages the keys, so the customer neither supplies a key per request nor retains ownership of it.
- B. SSE-KMS keeps keys in AWS KMS, meaning AWS-side policies and logging govern each use rather than the customer handing over the raw key themselves.
- D. Client-side encryption encrypts data before it reaches S3, so S3 performs no server-side encryption as the scenario requires.