Serverless Data Analysis with S3 CRR and SSE-S3

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

C Use SSE-S3 for encryption and Amazon Athena for serverless querying of existing S3 data replicated via CRR.

Question

A company wants to move its application to a serverless solution. The serverless solution needs to analyze existing and new data by using SL. The company stores the data in an Amazon S3 bucket. The data requires encryption and must be replicated to a different AWS Region.
Which solution will meet these requirements with the LEAST operational overhead?
  1. Create a new S3 bucket. Load the data into the new S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with AWS KMS multi-Region kays (SSE-KMS). Use Amazon Athena to query the data.
  2. Create a new S3 bucket. Load the data into the new S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use Amazon RDS to query the data.
  3. Load the data into the existing S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Use Amazon Athena to query the data. Correct Answer
  4. Load the data into the existing S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Use Amazon RDS to query the data.

Key Takeaways

The exam tests the ability to distinguish between managed services (SSE-S3) and complex key management (KMS), while recognizing that Athena is the correct serverless query tool compared to RDS.

This question evaluates the optimal serverless architecture for analyzing S3 data with cross-region replication and encryption, focusing on minimizing operational overhead through SSE-S3 and Athena.

Common mistake: Candidates often choose Option A because they mistakenly believe SSE-KMS is required for cross-region scenarios or overlook that SSE-S3 fully supports replication with less management effort.

Expert Analysis

Why the Answer Is Correct

Option C is the correct answer because it leverages Amazon S3 managed encryption keys (SSE-S3) and Amazon Athena, both of which are fully managed, serverless services requiring zero infrastructure maintenance. SSE-S3 automatically encrypts objects at rest and works seamlessly with S3 Cross-Region Replication (CRR) without the operational burden of managing KMS keys or permissions. Athena allows for ad-hoc SQL queries directly against data in S3, fitting the 'serverless analysis' requirement perfectly.

Why the Other Options Are Wrong

Options B and D are incorrect because Amazon RDS is a relational database service, not a serverless analytics tool for raw S3 data; querying S3 directly with Athena is far more appropriate. Option A is incorrect because it involves creating a new bucket and using SSE-KMS. While KMS offers flexibility, it introduces higher operational overhead due to key rotation, permission policies, and potential latency from API calls. Additionally, starting with a new bucket ignores the existing data unless a specific migration step is taken, whereas Option C uses existing data.

Community Comment Notes

Community consensus strongly favors Option C, with users noting that SSE-S3 is fully managed by AWS and requires no key management overhead compared to KMS. One user verified that SSE-S3 works correctly with CRR, debunking myths that KMS is mandatory for replication. Another user highlighted that Athena is the standard serverless query engine for S3, ruling out RDS immediately. The discussion clarified that 'least operational overhead' prioritizes fully managed defaults like SSE-S3 over customizable but complex KMS setups.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When asked for 'least operational overhead,' always prioritize fully managed services (like SSE-S3, Lambda, Athena) over self-managed or partially managed ones (like KMS, EC2). Identify keywords like 'serverless' to rule out traditional compute or database services like RDS or EC2.

Frequently Asked Questions

Why is SSE-S3 better than SSE-KMS for this scenario?

SSE-S3 is fully managed by AWS, requiring zero key management overhead. SSE-KMS requires managing key permissions, rotation, and incurs API call costs, increasing operational complexity.

Can Amazon Athena be used to query encrypted S3 data?

Yes, Athena automatically handles decryption if the data is encrypted with SSE-S3 or SSE-KMS, provided the IAM role has access to the data and keys.

More SAA-C03 FAQ →

Discussion 155 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 155

  1. 123jhl0 👍 68 Answered C
    SSE-KMS vs SSE-S3 - The last seems to have less overhead (as the keys are automatically generated by S3 and applied on data at upload, and don't require further actions. KMS provides more flexibility, but in turn involves a different service, which finally is more "complex" than just managing one (S3). So A and B are excluded. If you are in doubt, you are having 2 buckets in A and B, while just keeping one in C and D. https://s3browser.com/server-side-encryption-types.aspx Decide between C and D is deciding on Athena or RDS. RDS is a relational db, and we have documents on S3, which is the use case for Athena. Athena is also serverless, which eliminates the need of controlling the underlying infrastructure and capacity. So C is the answer. https://aws.amazon.com/athena/
  2. dokaedu 👍 33
    Answer is A: Amazon S3 Bucket Keys reduce the cost of Amazon S3 server-side encryption using AWS Key Management Service (SSE-KMS). This new bucket-level key for SSE can reduce AWS KMS request costs by up to 99 percent by decreasing the request traffic from Amazon S3 to AWS KMS. With a few clicks in the AWS Management Console, and without any changes to your client applications, you can configure your bucket to use an S3 Bucket Key for AWS KMS-based encryption on new objects. The Existing S3 bucket might have uncrypted data - encryption will apply new data received after the applying of encryption on the new bucket.
  3. Nicknameinvalid 👍 18 Answered A
    Option C is not the best solution because it uses server-side encryption with Amazon S3 managed encryption keys (SSE-S3), which is not multi-Region. This means that the encryption key will only be available in the Region where the S3 bucket resides and cannot be replicated to another Region. As a result, if the bucket needs to be replicated to another Region, it will require extra steps to ensure that the encryption keys are also available in the new Region. In contrast, option A uses server-side encryption with AWS KMS multi-Region keys (SSE-KMS), which can be replicated to another Region and makes it easier to manage the encryption keys in a multi-Region setup.
  4. kels1 👍 13
    Crap man! I hate these at 51/49 % where's the truth man? I'm just here to study... lol :)
  5. athiha 👍 7 Answered A
    The only reason why I choose option A is that the question states "Serverless Solutions needs to analyze existing and new data". And when you turn on the Cross-Region Replication (CRR), the existing data will not be replicated automatically. It only replicates the new data added to the source bucket from the point you turn on CRR. So it would make more sense to have a new bucket to load the data and then turn on the CRR.
Show 25 more comments
  1. pentium75 👍 7 Answered C
    Data in S3 is queried with Athena, not RDS, thus B and D are out. A requires a new bucket and loading data into that - Why, since data is already in S3? It says to enable CRR only after loading the data, so existing data won't be replicated anyway. C uses existing data (less operational overhead compared to loading data into a new bucket) and SSE-E3 (less operational overhead than SSE-KMS).
  2. Wajif 👍 6 Answered A
    Athena being serverless and offers less operational overhead so ruling out B&D. C: SSE-S3 has higher operational overhead but it doesnt achieve the GOAL which is to encrypt all objects. Hence the answer is A: https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html "Changes to note before enabling default encryption After you enable default encryption for a bucket, the following encryption behavior applies: There is no change to the encryption of the objects that existed in the bucket before default encryption was enabled."
  3. kerl 👍 6
    Answer is C, i have manually tested using SS3-S3 for encryption and test the relication and it work. For existing data, before u save your replication rules, S3 will asked if u want to replicate existing data to a new S3 bucket using Batch Operation Job.
  4. LuckyAro 👍 6
    I didn't read anywhere in the question where cost was an issue of consideration, so how you made it a main issue here is beyond me.
  5. RODROSKAR 👍 6
    Reducing cost was never the target, it's LEAST operational. In that regard SSE-S3 AWS fully managed.
  6. TariqKipkemei 👍 5 Answered A
    Technically both A and C will work, but there is a requirement for 'LEAST operational overhead'. Multi-Region keys are a flexible and powerful solution for many common data security scenarios such as this: Global data management Businesses that operate globally need globally distributed data that is available consistently across AWS Regions. You can create multi-Region keys in all Regions where your data resides, then use the keys as though they were a single-Region key without the latency of a cross-Region call or the cost of re-encrypting data under a different key in each Region.
  7. Jeyaluxshan 👍 5
    If you use S3 managed encryption key , it will apply to newly uploaded objects, not to existing objects. C & D is wrong. which state use existing bucket. Athena is to query in S3 so no need of RDS. B is wrong. Correct Answer is A - use KMS key
  8. masetromain 👍 5 Answered A
    for me the answer is A: The Existing S3 bucket might have uncrypted data - encryption will apply new data received after the applying of encryption on the new bucket.
  9. thewalker 👍 4 Answered C
    As per Amazon Q: The easiest way to encrypt existing objects in S3 is to use server-side encryption with S3-managed keys (SSE-S3). Here are the basic steps: 1. Enable SSE-S3 on the target S3 bucket if it is not already enabled. This will ensure all new or copied objects are encrypted automatically. 2. Create an S3 inventory report for the source bucket containing the objects. This will generate a CSV file with metadata of all objects. 3. Use S3 Select or AWS Athena to query the inventory report and filter for only unencrypted objects. 4. Create an S3 Batch Operations job to copy the filtered unencrypted objects to the target bucket. The copy operation will automatically encrypt the objects using the bucket's SSE-S3 configuration.
  10. djgodzilla 👍 4 Answered A
    The most suitable solution with the least operational overhead for the company's requirements is: Option A: Create a new S3 bucket. Load the data into the new S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use Amazon Athena to query the data. This option aligns with the specified requirements of encrypting the data, replicating it to a different AWS Region, and utilizing serverless querying with Amazon Athena. It also minimizes operational overhead by leveraging AWS managed services.
  11. lfrad 👍 4 Answered A
    My question is about CRR: since we need to replicate all data both new and old, shouldn't the existing bucket option be out of the window as CRR does not replicate already present data but only new PUTs ? In this case the question would trick you into answering C as SSE-S3 is less operational overhead over SSE-KMS, BUT it not a feasible architecture as the CRR choice (instead of say batch replication or s3 sync command) would not allow existing data to be transferred. So SSE-S3 better, but C is not feasible... so A ?
  12. tom_cruise 👍 4 Answered A
    "To encrypt an existing object using SSE, you replace the object. To encrypt existing objects in place, you can use the Copy Object or Copy Part API. This copies the objects with the same name and encrypts the object data using server-side encryption." https://aws.amazon.com/blogs/storage/encrypting-existing-amazon-s3-objects-with-the-aws-cli/#:~:text=To%20encrypt%20an%20existing%20object,data%20using%20server%2Dside%20encryption.
  13. ChandraPrabu 👍 4 Answered A
    Existing objects in the source bucket will not be replicated to the destination bucket unless you manually copy them to the destination bucket or use another method such as Amazon S3 inventory and Amazon S3 batch operations. In that case option A makes sense to copy the exiting data to new bucket & make them replicated in destination bucket.
  14. kmargaronis 👍 4 Answered C
    C. is correct after January 2023 because "Amazon S3 now applies server-side encryption with Amazon S3 managed keys (SSE-S3) as the base level of encryption for every bucket in Amazon S3. Starting January 5, 2023, all new object uploads to Amazon S3 are automatically encrypted at no additional cost and with no impact on performance. "
  15. study_aws1 👍 4
    The issue with Option C) is the existing data before setting up CRR will not be replicated and that is why option A) looks good. The question does not talk of employing S3 Batch Replication before CRR is setup.
  16. PaulGa 👍 4 Answered A
    Ans A - once you realise "SL" is a typo for "ML" then its only the Athena options, and in the case of option it means setting up a new S3 bucket
  17. pentium75 👍 4
    It says "data requires encryption", not that it must use same key in both regions.
  18. UWSFish 👍 4
    The question should read "SQL" not "SL"
  19. simplimarvelous 👍 3
    So would have to go with answer A this with this question. - with no specific information telling that existing data is encrypted a new bucket should be created so that new data will be encrypted. By default existing encrypted at rest object are not replicated without having to having to do additional work to tell S3 to replicate it. https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough-4.html The documentation does say the following: https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html Changes to note before enabling default encryption SSE-S3 After you enable default encryption for a bucket, the following encryption behavior applies: "There is no change to the encryption of the objects that existed in the bucket before default encryption was enabled."
  20. nazirlia 👍 3 Answered C
    Option C provides a correct solution that meets the given requirements with the least operational overhead. Data is loaded into the existing S3 bucket, and the S3 Cross-Region Replication (CRR) feature is used to replicate the data to an S3 bucket in a different AWS region. The data is encrypted server-side using Amazon S3 managed encryption keys (SSE-S3). Amazon Athena can be used to query the data.
  21. Fielies23 👍 3
    As a side note, if a bucket already exists and you enable replication, you CAN actually now also replicate the existing object in the bucket with "Amazon S3 Batch Replication". https://aws.amazon.com/blogs/aws/new-replicate-existing-objects-with-amazon-s3-batch-replication/#:~:text=S3%20Replication%20is%20a%20fully,or%20to%20multiple%20destination%20buckets.
  22. Chiznitz 👍 3
    Answer A has you move the data before you enable replication, therefore there is no difference between A and C when it comes to the point in time you enable replication. I agree A would be a better choice if the order of operations said, create a bucket->Enable encryption->move files...but it doesn't. It has you create the bucket and move the files.
  23. asoli 👍 3 Answered A
    it says existing objects and new objects. When you enable cross-region replication on an s3 bucket, it only replicates the new objects and you have to take care of the existing objects to copy them to the new bucket. which has more operational overhead.
  24. justtry 👍 3 Answered A
    https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html There is no change to the encryption of the objects that existed in the bucket before default encryption was enabled.That's the reason why new bucket should be created.
  25. Robrobtutu 👍 3
    This is a tricky one. C would have less operational overhead, but CRR doesn't encrypt already existing objects, so you'd need to create a new bucket, upload the existing data to the new bucket, and then encrypt the bucket.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Scheduled scaling for a predictable morning EC2 traffic spike

S-grade

Improving RDS Performance with Provisioned IOPS SSD

S-grade

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide