Which S3 Encryption Option Lets Only Specific Employees Access the Keys?

Ensure data encryption and masking. Apply authorization mechanisms.

Answer Correct answer: C — Turn on SSE-KMS for the S3 objects and attach an IAM policy that restricts access to the KMS keys.

A company receives call logs as Amazon S3 objects that contain sensitive customer information. The company must protect the S3 objects by using encryption. The company must also use encryption keys that only specific employees can access. Which solution will meet these requirements with the LEAST effort?

Use an AWS CloudHSM cluster to store the encryption keys. Configure the process that writes to Amazon S3 to make calls to CloudHSM to encrypt and decrypt the objects. Deploy an IAM policy that restricts access to the CloudHSM cluster.
Use server-side encryption with customer-provided keys (SSE-C) to encrypt the objects that contain customer information. Restrict access to the keys that encrypt the objects.
Use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the objects that contain customer information. Configure an IAM policy that restricts access to the KMS keys that encrypt the objects. Correct Answer
Use server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the objects that contain customer information. Configure an IAM policy that restricts access to the Amazon S3 managed keys that encrypt the objects.

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests whether you can pick the S3 encryption option that supports key-level access control with minimum operational effort — the trap is choosing SSE-S3 because it is the easiest to switch on while ignoring that its keys cannot be restricted.

Protecting S3 call logs with encryption keys that only specific employees can use points to SSE-KMS combined with an IAM policy scoped to the KMS key. This page confirms why SSE-KMS is the least-effort fit compared with CloudHSM, SSE-C, and SSE-S3.

Picking SSE-S3 (option D) because it is the default, zero-configuration encryption mode — but S3-managed keys are not customer-visible or IAM-controllable, so the requirement that only specific employees can access the keys cannot be met.

Community Discussion (5 comments)

Ousseyni 👍 3 Selected: C

C. Use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the objects that contain customer information. Configure an IAM policy that restricts access to the KMS keys that encrypt the objects. Server-side encryption with AWS KMS (SSE-KMS) provides strong encryption for S3 objects while allowing fine-grained access control through AWS Key Management Service (KMS). With SSE-KMS, you can control access to encryption keys using IAM policies, ensuring that only specific employees can access them. This solution requires minimal effort as it leverages AWS's managed encryption service (SSE-KMS) and integrates seamlessly with S3. Additionally, IAM policies can be easily configured to restrict access to the KMS keys, providing granular control over who can access the encryption keys.

Christina666 👍 3 Selected: C

Encryption at Rest: SSE-KMS provides robust encryption of the sensitive call log data while it's stored in S3. Key Management and Access Control: AWS KMS offers centralized key management. You can easily create and manage KMS keys (Customer Master Keys - CMKs) and use fine-grained IAM policies to restrict access to specific employees. Minimal Effort: SSE-KMS is a built-in S3 feature. Enabling it requires minimal configuration and no custom code for encryption/decryption.

FuriouZ 👍 1 Selected: C

KMS because you can restrict access and of course for pricing ;)

GiorgioGss 👍 4 Selected: C

Least effort = C

rralucard_ 👍 4 Selected: C

Option D does not provide the ability to restrict access to the encryption keys

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

SSE-KMS encrypts the objects with an AWS KMS key while S3 handles the encryption and decryption transparently, so no application code changes are needed beyond setting the encryption on the bucket or object. KMS key policies and IAM policies give fine-grained control over who can call kms:Decrypt and kms:GenerateDataKey, which is exactly the requirement that only specific employees can reach the keys. It is a managed, built-in S3 feature, so it satisfies the LEAST-effort constraint relative to building a CloudHSM client or managing keys yourself. That combination of native integration plus key-level authorization is why option C wins.

Why the Other Options Are Wrong

Option A requires the writing process to make explicit calls to an AWS CloudHSM cluster to encrypt and decrypt, which means custom code, cluster operations, and high cost — maximum effort, not least. Option B (SSE-C) leaves the key entirely in the company's hands: every PUT/GET must carry the encryption key, and the company must handle storage, rotation, and delivery of those keys securely. Option D (SSE-S3) encrypts with Amazon S3 managed keys that the customer never sees, so an IAM policy cannot restrict access to them — the key-restriction requirement simply cannot be satisfied.

Community Comment Notes

All ten learners voted for C, and as rralucard_ put it, "Option D does not provide the ability to restrict access to the encryption keys" — that single sentence is the crux of the item. GiorgioGss summarized the effort angle with "Least effort = C", while Ousseyni highlighted that SSE-KMS is a built-in S3 feature that still allows fine-grained access control through KMS key policies. FuriouZ added the practical note that KMS is chosen both for restrictability and for cost, since CloudHSM is far more expensive to run.

Official Reference

Exam Strategy

When an S3 encryption question mentions restricting who can use the keys, eliminate SSE-S3 immediately — S3-managed keys are invisible and uncontrollable. Then compare effort: SSE-KMS is a checkbox plus an IAM/key policy, while SSE-C and CloudHSM both push key custody and code onto the company.

Frequently Asked Questions

Why can't an IAM policy restrict access to keys when using SSE-S3?

SSE-S3 uses Amazon S3 managed keys that AWS owns and rotates; they are never exposed, so there is no key resource an IAM policy could reference.

Why is SSE-C more effort than SSE-KMS here?

With SSE-C the company must supply the encryption key on every request and securely store, rotate, and deliver it, whereas SSE-KMS keeps the key in KMS and encrypts transparently.

More DEA-C01 FAQ →

Related Analysis

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide