Q77 — AWS SAA-C03 Ch.11

Question 77 of 100 | ← Chapter 11

Q777. A company needs to provide customers with secure access to its data. The company processes customer data and stores the results in an Amazon S3 bucket.All the data is subject to strong regulations and security requirements. The data must be encrypted at rest. Each customer must be able to access only their data from their AWS account. Company employees must not be able to access the data.Which solution will meet these requirements?

• A. Provision an AWS Certificate Manager (ACM) certificate for each customer. Encrypt the data client-side.In the private certificate policy, deny access to the certificate for all principals except an IAM role that the customer provides.
• B. Provision a separate AWS Key Management Service (AWS KMS) key for each customer. Encrypt the data server-side. In the S3 bucket policy, deny decryption of data for all principals except an IAM role that the customer provides.
• C. Provision a separate AWS Key Management Service (AWS KMS) key for each customer. Encrypt the data server-side. In each KMS key policy, deny decryption of data for all principals except an IAM role that the customer provides. ✓
• D. Provision an AWS Certificate Manager (ACM) certificate for each customer. Encrypt the data client-side.In the public certificate policy, deny access to the certificate for all principals except an IAM role that the customer provides.

Correct Answer: C. Provision a separate AWS Key Management Service (AWS KMS) key for each customer. Encrypt the data server-side. In each KMS key policy, deny decryption of data for all principals except an IAM role that the customer provides.

Explanation

\1. Provision a separate AWS Key Management Service (AWS KMS) key for each customer: By using separate KMS keys for each customer, data encryption can be managed at the customer level. Each customer can have their own KMS key to encrypt their data.\2. Encrypt the data server-side: With server-side encryption, the data stored in the Amazon S3 bucket will be encrypted using the customer's specific KMS key. This ensures that the data is encrypted at rest.\3. In each KMS key policy, deny decryption of data for all principals except an IAM role that the customer provides: The KMS key policy can be configured to restrict access to the encrypted data. By denying decryption of the data for all principals except an IAM role provided by the customer, only the customer's specific IAM role will have the necessary permissions to decrypt and access the data.Here's why the other options are not the most suitable choices:A. Provision an AWS Certificate Manager (ACM) certificate for each customer. Encrypt the data client-side. In the private certificate policy, deny access to the certificate for all principals except an IAM role that the customer provides:AWS Certificate Manager (ACM) is primarily used for managing SSL/TLS certificates and does not directly address the encryption and access control requirements for customer data stored in S3. Client-side encryption using certificates would require additional custom implementations and may not provide the desired level of access control.B. Provision a separate AWS Key Management Service (AWS KMS) key for each customer. Encrypt the data server-side. In the S3 bucket policy, deny decryption of data for all principals except an IAM role that the customer provides:While provisioning separate KMS keys for each customer and encrypting the data server-side is a valid approach, managing access control solely through an S3 bucket policy may not be as granular or flexible as using KMS key policies to control access to the encrypted data.D. Provision an AWS Certificate Manager (ACM) certificate for each customer. Encrypt the data client-side. In the public certificate policy, deny access to the certificate for all principals except an IAM role that the customer provides:Similar to option A, using ACM certificates for client-side encryption does not directly address the encryption and access control requirements for customer data stored in S3. Additionally, managing access control through public certificate policies may not provide the desired level of granularity or control.Therefore, the most suitable solution to meet the requirements of providing secure access to customer data, encrypting the data at rest, ensuring customer-specific access control, and preventing company employees from accessing the data is:C. Provision a separate AWS Key Management Service (AWS KMS) key for each customer. Encrypt the data server-side. In each KMS key policy, deny decryption of data for all principals except an IAM role that the customer provides.