A healthcare startup must guarantee that plaintext patient files never reach AWS storage servers, even briefly, and the encryption keys must stay under the company's control. Which approach meets both requirements?
Show answer and explanation
Answer: C
Client-side encryption means the application encrypts data before sending it, so S3 only receives ciphertext and never sees the plaintext. The company holds the key material and controls its lifecycle. The three server-side options all require S3 to receive the plaintext and encrypt it there, even when the company supplies or chooses the key.
Why the other options are wrong
- A. With SSE-S3, S3 receives the plaintext file and encrypts it on arrival. AWS also manages the keys, which does not meet the requirement for company control.
- B. SSE-KMS still has S3 receive plaintext before encrypting it with the KMS key. The key is under control, but plaintext does reach AWS storage servers.
- D. With SSE-C, S3 receives the plaintext over TLS and encrypts it using the supplied key. The plaintext still arrives at AWS, so this does not satisfy the requirement.