A healthcare analytics firm keeps research datasets in S3. Its regulator requires that the cloud provider never be able to read plaintext, and the firm must keep the key material in a location it alone controls. Which design satisfies this?
Show answer and explanation
Answer: A
Client-side encryption performs the cryptography before data leaves the application. Only ciphertext reaches S3, so AWS never handles plaintext. Using the AWS Encryption SDK with a key the firm keeps outside AWS means the firm alone holds the key material. Server-side options all have AWS process plaintext during encryption, and AWS managed keys are controlled by AWS.
Why the other options are wrong
- B. With SSE-S3, S3 manages the keys and performs encryption on the server side. The firm holds no key material, and AWS handles plaintext during the write.
- C. AWS managed keys are controlled and administered by AWS, so the firm cannot hold or control the key material. Decryption on the server side still happens inside AWS.
- D. Versioning and Object Lock protect against deletion and overwriting. They do not address who can read the plaintext, so the confidentiality requirement is unmet.