AWS KMS Key Management for Multi-Tenant Data

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

D Create separate AWS KMS keys for each customer's data that have granular access control and logging enabled.

Question

A company is designing an application on AWS that processes sensitive data. The application stores and processes financial data for multiple customers. To meet compliance requirements, the data for each customer must be encrypted separately at rest by using a secure, centralized key management solution. The company wants to use AWS Key Management Service (AWS KMS) to implement encryption. Which solution will meet these requirements with the LEAST operational overhead?
  1. Generate a unique encryption key for each customer. Store the keys in an Amazon S3 bucket. Enable server-side encryption.
  2. Deploy a hardware security appliance in the AWS environment that securely stores customer-provided encryption keys. Integrate the security appliance with AWS KMS to encrypt the sensitive data in the application.
  3. Create a single AWS KMS key to encrypt all sensitive data across the application.
  4. Create separate AWS KMS keys for each customer's data that have granular access control and logging enabled. Correct Answer

Key Takeaways

The question tests the balance between strict data isolation compliance and operational efficiency, where the common trap is assuming a single key or manual storage is sufficient.

This page explains how to implement separate encryption keys per customer using AWS KMS with minimal operational overhead. It establishes that granular key management satisfies compliance requirements while leveraging native AWS controls.

Common mistake: Candidates often choose Option A because it mentions server-side encryption, but failing to recognize that storing keys in S3 lacks centralized management and auditing capabilities provided by KMS.

Expert Analysis

Why the Answer Is Correct

Option D is the correct solution because it leverages AWS KMS to create separate keys for each customer, ensuring logical separation of sensitive data as required by compliance standards. By enabling granular access control (via IAM policies) and logging (via CloudTrail), the organization meets security auditing needs without managing hardware or complex custom solutions. This approach minimizes operational overhead compared to manual key management or third-party appliances.

Why the Other Options Are Wrong

Option A is incorrect because storing encryption keys in an S3 bucket is not a secure or centralized key management practice; it lacks the robust auditing and access control features of KMS. Option B is incorrect because deploying a hardware security appliance introduces significant operational overhead and complexity, violating the 'least operational overhead' requirement. Option C is incorrect because using a single key for all customers fails to meet the requirement for separate encryption per customer, potentially exposing all data if one key is compromised.

Community Comment Notes

The community consensus strongly supports Option D, with comments noting that it offers the best balance of security and management ease. As one user noted, "D is more secure" due to the granular controls inherent in KMS. Another commenter highlighted that "D is with less management overhead" compared to other methods. The general agreement reflects the exam's focus on AWS-native managed services for compliance.

Exam Strategy

Always look for keywords like 'least operational overhead' when evaluating AWS managed services versus self-managed solutions. For multi-tenant applications requiring data isolation, prefer AWS KMS with separate keys over shared keys or external hardware.

Frequently Asked Questions

Why is Option A not suitable for centralized key management?

Storing keys in S3 lacks the centralized audit trail and fine-grained access control that AWS KMS provides natively.

Does using separate KMS keys increase costs significantly?

While there is a small cost per key, it is negligible compared to the operational overhead of managing external appliances or manual key storage.

More SAA-C03 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. officedepotadmin 👍 7 Answered D
    While enabling server-side encryption in S3 can manage encryption, it does not offer the same level of control and auditing as AWS KMS. Managing individual keys manually in S3 would also increase operational overhead.
  2. muhammadahmer36 👍 2 Answered D
    hile enabling server-side encryption in S3 can manage encryption, it does not offer the same level of control and auditing as AWS KMS. Managing individual keys manually in S3 would also increase operational overhead.
  3. Jeyaluxshan 👍 2
    D is with less management overhead
  4. progounick 👍 1 Answered D
    it is obvious that D is correct
  5. nebajp 👍 2 Answered D
    D is the correct Answer
Show 1 more comment
  1. dhewa 👍 2 Answered D
    D is more secure

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide