A company stores sensitive customer data in Amazon S3. It requires encryption at rest with keys the company itself manages, plus a full audit trail of every key usage event. Which option meets these requirements?
Show answer and explanation
Answer: B
With SSE-KMS and a customer-managed key, the company controls the key policy, decides who may use the key and for which operations, and can enable automatic rotation. Every encrypt and decrypt call against the key is logged by CloudTrail as a KMS API event, which produces the per-usage audit record the requirement asks for.
SSE-S3 keys sit fully inside AWS control with no per-bucket key policy or usage log, and SSE-C puts the burden of supplying and protecting the raw key on every request with no AWS-side audit trail.
Why the other options are wrong
- A. SSE-S3 manages the keys entirely within AWS under an alias the customer cannot control, rotate, or audit, so it fails both the control and the audit-trail requirements.
- C. SSE-C requires the customer to send the raw encryption key with every request and provides no AWS-side record of key usage or centralized key management.
- D. Client-side encryption with an on-premises key pushes the entire key lifecycle and encryption library onto the company's own infrastructure, losing the KMS integration and CloudTrail key-usage auditing.