AWS Certified Solutions Architect – Professional — Question 893

The company Security team requires that all data uploaded into an Amazon S3 bucket must be encrypted. The encryption keys must be highly available and the company must be able to control access on a per-user basis, with different users having access to different encryption keys.
Which of the following architectures will meet these requirements? (Choose two.)

Answer options

• A. Use Amazon S3 server-side encryption with Amazon S3-managed keys. Allow Amazon S3 to generate an AWS/S3 master key, and use IAM to control access to the data keys that are generated.
• B. Use Amazon S3 server-side encryption with AWS KMS-managed keys, create multiple customer master keys, and use key policies to control access to them.
• C. Use Amazon S3 server-side encryption with customer-managed keys, and use AWS CloudHSM to manage the keys. Use CloudHSM client software to control access to the keys that are generated.
• D. Use Amazon S3 server-side encryption with customer-managed keys, and use two AWS CloudHSM instances configured in high-availability mode to manage the keys. Use the CloudHSM client software to control access to the keys that are generated.
• E. Use Amazon S3 server-side encryption with customer-managed keys, and use two AWS CloudHSM instances configured in high-availability mode to manage the keys. Use IAM to control access to the keys that are generated in CloudHSM.

Correct answer: B, D

Explanation

Option B satisfies the requirements because AWS KMS is inherently highly available, and using multiple CMKs with key policies allows granular, per-user access control. Option D is also correct because configuring two AWS CloudHSM instances in high-availability mode meets the availability requirement, and the CloudHSM client software must be used for key access control since IAM cannot manage internal CloudHSM keys. Option A is incorrect because SSE-S3 does not support granular, user-level key access control, while Options C and E fail because a single CloudHSM is not highly available and IAM cannot control access to keys inside CloudHSM.