Q19 — AWS SAA-C03 Ch.17

Question 19 of 89 | ← Chapter 17

Q1319. A software as a service(SaaS) company runs a multi-tenant data lake by using Amazon S3. Each tenant's data is stored in an isolated data path in an S3 bucket. The data lake supports custom encryption for each tenant.The company wants to allow tenants to use their own keys to encrypt only a subset of their data. The rest of the data will use server-side encryption with Amazon S3 managed keys(SSE-S3). The company needs to set up ongoing data replication to another S3 bucket in a different AWS Region for the objects encrypted with imported keys.Which solution will meet these requirements?

Correct Answer: C. Use S3 prefixes for each tenant's data. Use server-side encryption with AWS KMS keys(SSE-KMS). Set up prefix-based Cross-Region Replication(CRR) to another S3 bucket.

Explanation

The correct solution that meets the requirements is:C. Use S3 prefixes for each tenant's data. Use server-side encryption with AWS KMS keys (SSE-KMS). Set up prefix-based Cross-Region Replication (CRR) to another S3 bucket.Why Option C is Correct:Multi-Tenant Isolation with S3 PrefixesUsing S3 prefixes (e.g., tenant-a/, tenant-b/) allows logical isolation of tenant data within a single bucket while avoiding the complexity of managing multiple buckets (as in Option D). Support for Tenant-Managed Keys (SSE-KMS with Customer-Managed CMKs) SSE-KMS supports both AWS-managed keys (SSE-S3 alternative) and customer-managed KMS keys (CMKs).Tenants can use their own AWS KMS Customer-Managed Keys (CMKs) to encrypt a subset of their data (via IAM policies or S3 object encryption settings).The rest of the data can use SSE-S3 (default) or SSE-KMS with AWS-managed keys (if no tenant-specific key is provided).Prefix-Based Cross-Region Replication (CRR) for Imported Keys SSE-KMS is required for CRR when encryption keys are involved (unlike SSE-C, which does not support replication).By setting up prefix-based CRR, only objects in specific prefixes (e.g., those encrypted with tenant-provided CMKs) are replicated to the destination bucket.AWS KMS automatically handles key synchronization across regions if the CMK is replicated (using AWS KMS multi-region keys or manual replication).Why Other Options Are Incorrect:A. Use S3 prefixes + SSE-KMS + Tag-Based CRRTag-based CRR is not suitable here because the requirement is to replicate only objects encrypted with tenant-provided keys, not based on arbitrary tags.Prefix-based CRR is more precise for this use case.B. Use S3 prefixes + SSE-C + Prefix-Based CRRSSE-C (Customer-Provided Keys) does not support Cross-Region Replication (CRR) because AWS does not store or manage the customer-provided keys, making replication impossible. The replication process would fail since the destination bucket cannot decrypt the objects without the original key.D. Create Separate S3 Buckets + SSE-C + Bucket-Level CRRManaging separate buckets per tenant is not scalable and increases operational overhead (monitoring, permissions, costs).SSE-C still does not support CRR, so this approach fails the replication requirement.Implementation Steps for Option C:Organize Data with S3 PrefixesStructure the bucket with prefixes like:s3://data-lake-bucket/tenant-a/encrypted-data/s3://data-lake-bucket/tenant-a/default-data/s3://data-lake-bucket/tenant-b/encrypted-data/Configure SSE-KMS with Customer-Managed CMKs (Optional)Tenants can provide their AWS KMS CMKs (or the company can create them on behalf of tenants). For objects requiring tenant-managed encryption, specify the CMK in the S3 PUT request or via bucket policies:json{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": "","Action": ["s3:PutObject"],"Resource": ["arn:aws:s3:::data-lake-bucket/tenant-a/encrypted-data/"], "Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms","s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/ abcd1234-5678-90ef-ghij-klmnopqrstuv"}}}]}Set Up Prefix-Based CRRGo to S3 Bucket Management Replication Add rule.Select "Prefix-based" and specify paths like tenant-a/encrypted-data/.Choose a destination bucket in another region.Under "Encryption configuration", select "AWS KMS" and specify a replicated CMK (or let AWS create one). If using tenant-provided CMKs, ensure they are replicated to the destination region (via AWS KMS multi- region keys or manual replication).Verify ReplicationUpload a test object to tenant-a/encrypted-data/ with the tenant's CMK. Check the destination bucket for the replicated object with the same encryption settings.Key Considerations:KMS Key ReplicationIf tenant-provided CMKs are used, they must be replicated to the destination region (via AWS KMS multi- region keys or manual key export/import).Alternatively, use separate CMKs per region and update IAM policies accordingly.Cost OptimizationCRR incurs storage costs in the destination region and request costs for replication. Use S3 Intelligent-Tiering in the destination bucket to reduce long-term storage costs.Security & ComplianceEnsure least-privilege IAM roles for replication (only allow S3 and KMS actions needed). Enable S3 Versioning and MFA Delete in both buckets for data protection.Conclusion:Option C is the best choice because it: