Q55 — AWS SAA-C03 Ch.14

Question 55 of 100 | ← Chapter 14

Q1055. A company runs an environment where data is stored in an Amazon S3 bucket. The objects are accessed frequently throughout the day. The company has strict da ta encryption requirements for data that is stored in the S3 bucket. The company currently uses AWS Key Management Service (AWS KMS) for encryption.The company wants to optimize costs associated with encrypting S3 objects without making additional calls to AWS KMS.Which solution will meet these requirements?

Correct Answer: B. Use an S3 Bucket Key for server-side encryption with AWS KMS keys (SSE-KMS) on the new objects.

Explanation

To optimize costs associated with encrypting S3 objects while using AWS KMS for encryption and avoiding additional calls to KMS, the best solution is:B. Use an S3 Bucket Key for server-side encryption with AWS KMS keys (SSE-KMS) on the new objects.Explanation:\1. S3 Bucket Key: - An S3 Bucket Key is designed to reduce the cost of using AWS KMS for encrypting objects in S3. It allows you to use a single bucket-level KMS key instead of making a separate KMS API call for each object. This significantly lowers the number of requests to KMS, thereby reducing associated costs.\2. Compliance with Encryption Requirements: - Using SSE-KMS with an S3 Bucket Key still meets the company’s strict encryption requirements because it utilizes AWS KMS for managing encryption keys, ensuring robust security.\3. Cost Optimization: - By leveraging the S3 Bucket Key feature, the company can keep the benefits of KMS encryption while minimizing the number of KMS calls, leading to cost savings.Evaluation of Other Options:A. Use server-side encryption with Amazon S3 managed keys (SSE-S3): - While SSE-S3 is a cost-effective option without additional KMS calls, it does not fulfill the company's requirement to use AWS KMS for encryption.C. Use client-side encryption with AWS KMS customer managed keys: - Client-side encryption shifts the responsibility of managing encryption to the client, which may introduce complexity and does not optimize the cost of KMS usage for S3 storage.D. Use server-side encryption with customer-provided keys (SSE-C) stored in AWS KMS: - This option involves managing your own encryption keys, which complicates the encryption process and does not leverage the cost benefits and simplicity of AWS KMS.Conclusion:Option B is the optimal solution that meets the company's encryption requirements while optimizing costs associated with AWS KMS by using an S3 Bucket Key for server-side encryption.