Compliance requires that the company controls the keys used to encrypt data in S3, including the ability to rotate keys and audit every key usage. Which encryption option meets these requirements?
A.SSE-S3 with Amazon S3 managed keys
SSE-S3 uses keys fully managed by Amazon; the customer cannot control rotation or audit key use.
B.SSE-KMS with a customer managed key (CMK)
Correct. Customer managed KMS keys provide control, rotation, and CloudTrail audit of key usage.
C.Client-side encryption with keys stored in a spreadsheet
Spreadsheets are not a key management system; client-side encryption is possible but this approach is insecure.
D.TLS encryption in transit only
TLS protects data in transit, not data at rest.
Why this answer
SSE-KMS with a customer managed key gives the company control over key policies, rotation, and disablement, and every use of the key is logged in CloudTrail for auditing.
Correct answer: B · Last reviewed 2026-10-25
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Protection & Encryption practice session.
Practice Data Protection & Encryption