Which S3 encryption type prevents third-party access to uploaded documents?

The core requirement is that the contents of the documents must not be accessible to any third party. While all options provide encryption, the question implicitly seeks the most practical and secure AWS-native solution.

Option C (SSE-KMS) is the correct answer because it leverages AWS Key Management Service (KMS) to manage the encryption keys. This provides a robust level of security where AWS handles the heavy lifting of key rotation and storage, but the developer retains control through IAM policies. Crucially, SSE-KMS integrates with AWS CloudTrail, allowing for detailed auditing of key usage, which is essential for compliance and security monitoring. As community members noted, this offers the best balance of security and manageability.

Option A (Client-side encryption with a Raw RSA key) is a strong contender and provides end-to-end encryption where the key never leaves the user's device. However, as highlighted by the community, this approach is overly complex for a standard document upload scenario. It requires the application to manage the encryption process entirely and places the burden of key management on the user. If the user loses the key, the data is unrecoverable. For most AWS-based applications, SSE-KMS is the recommended and more practical approach.

Option B (SSE-S3) uses S3-managed keys. While it provides basic encryption at rest, it lacks the granular access control and audit capabilities of KMS. You cannot define IAM policies that require the use of a specific KMS key, making it less secure from a governance perspective.

Option D (DSSE-KMS) applies two layers of encryption. While it offers the highest level of security, it is generally considered overkill for standard document storage and introduces unnecessary latency and cost.