S3 encryption options in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of encryption in Amazon S3?

Encryption in Amazon S3 protects data by converting it into a secure format that unauthorized users cannot read.

beginner

Name the three main types of encryption options available in Amazon S3.

The three main encryption options are: 1) Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3), 2) Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS), and 3) Client-Side Encryption.

beginner

What is SSE-S3 and how does it work?

SSE-S3 encrypts data at rest using keys managed by Amazon S3. It automatically encrypts data when saved and decrypts it when accessed, without user management of keys.

intermediate

How does SSE-KMS differ from SSE-S3?

SSE-KMS uses AWS Key Management Service to manage encryption keys, providing more control, audit logs, and the ability to create and rotate keys, unlike SSE-S3 which uses Amazon S3-managed keys.

intermediate

What is client-side encryption in Amazon S3?

Client-side encryption means data is encrypted by the user before sending it to S3. The user manages the encryption keys and decryption happens on the client side.

Which S3 encryption option automatically manages encryption keys without user intervention?

A SSE-S3

B SSE-KMS

C Client-side encryption

D None of the above

SSE-S3 uses Amazon S3-managed keys and automatically handles encryption and decryption.

Which encryption option provides audit logs and key rotation features?

A SSE-S3

B No encryption

C SSE-KMS

D Client-side encryption

SSE-KMS integrates with AWS KMS, which provides audit logs and key rotation.

Who manages the encryption keys in client-side encryption?

A Amazon S3

B AWS KMS

C AWS CloudTrail

D The user/client

In client-side encryption, the user manages the keys before uploading data.

Which encryption method encrypts data before it is sent to Amazon S3?

A Client-side encryption

B SSE-KMS

C SSE-S3

D S3 Versioning

Client-side encryption encrypts data on the client before upload.

What does SSE stand for in the context of Amazon S3?

A Secure Storage Encryption

B Server-Side Encryption

C Simple Storage Encryption

D System Security Enforcement

SSE means Server-Side Encryption, where encryption happens on the server side.

Explain the differences between SSE-S3, SSE-KMS, and client-side encryption in Amazon S3.

Think about who manages the keys and where encryption happens.

Why might a company choose SSE-KMS over SSE-S3 for their S3 data encryption?

Consider security and compliance needs.