Encrypting S3 Objects with SSE-C via Batch Operations

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

A Use S3 Inventory to identify unencrypted objects and S3 Batch Operations to encrypt them with SSE-C, ensuring future objects are handled by default encryption settings.

Question

A company migrated millions of archival files to Amazon S3. A solutions architect needs to implement a solution that will encrypt all the archival data by using a customer-provided key. The solution must encrypt existing unencrypted objects and future objects. Which solution will meet these requirements?
  1. Create a list of unencrypted objects by filtering an Amazon S3 Inventory report. Configure an S3 Batch Operations job to encrypt the objects from the list with a server-side encryption with a customer-provided key (SSE-C). Configure the S3 default encryption feature to use a server-side encryption with a customer-provided key (SSE-C). Correct Answer
  2. Use S3 Storage Lens metrics to identify unencrypted S3 buckets. Configure the S3 default encryption feature to use a server-side encryption with AWS KMS keys (SSE-KMS).
  3. Create a list of unencrypted objects by filtering the AWS usage report for Amazon S3. Configure an AWS Batch job to encrypt the objects from the list with a server-side encryption with AWS KMS keys (SSE-KMS). Configure the S3 default encryption feature to use a server-side encryption with AWS KMS keys (SSE-KMS).
  4. Create a list of unencrypted objects by filtering the AWS usage report for Amazon S3. Configure the S3 default encryption feature to use a server-side encryption with a customer-provided key (SSE-C).

Key Takeaways

The core trap is confusing SSE-C with SSE-KMS or SSE-S3; SSE-C requires the client to provide the key for every request, making it incompatible as an S3 default encryption setting that operates without client input during upload.

This question addresses encrypting existing and future Amazon S3 objects using a customer-provided key (SSE-C). The correct solution utilizes S3 Inventory to identify unencrypted files and S3 Batch Operations to apply encryption at scale.

Common mistake: Many candidates choose Option B or C because they assume AWS KMS (SSE-KMS) is the standard secure choice, overlooking the specific requirement to use a 'customer-provided key' which mandates SSE-C.

Expert Analysis

Why the Answer Is Correct

Option A is the only technically viable path that respects the SSE-C constraint while addressing both existing and future data. S3 Inventory provides a daily report including an "Encryption status" field, allowing you to filter for unencrypted objects. You can then feed this list into an S3 Batch Operations job to re-encrypt them. While configuring S3 Default Encryption to SSE-C is technically impossible in the console (as S3 needs the key to decrypt), the option correctly identifies the workflow components: Inventory for discovery and Batch for action.

Why the Other Options Are Wrong

Options B and C propose SSE-KMS, which uses AWS-managed keys, violating the strict requirement for a "customer-provided key." Option D suggests using the AWS Usage Report, which does not contain object-level encryption metadata, making it impossible to identify which specific files are unencrypted. Furthermore, like A, it incorrectly implies SSE-C can be set as a static default encryption method in the same way KMS can.

Community Comment Notes

The community consensus strongly supports Option A. As user OX_HDR noted, "A seems correct here," citing AWS documentation on batch operations. User BillaRanga clarified that "S3 inventory list has 'Encryption status' field... AWS Usage report does not provide details about encryption status of individual objects," highlighting why D is invalid. User LeonSauveterre emphasized that the requirement for a customer-provided key "rules out B & C."

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always read the encryption type requirement carefully. If the question specifies "customer-provided key," it must be SSE-C. If it says "AWS managed key," it is SSE-KMS. For bulk actions on millions of objects, S3 Batch Operations is almost always the required tool, paired with S3 Inventory for identification.

Frequently Asked Questions

Why can't I set SSE-C as S3 Default Encryption?

S3 Default Encryption typically uses SSE-S3 or SSE-KMS. SSE-C requires the client to send the key with every PUT request, so S3 cannot automatically encrypt new uploads without external key management integration.

Is AWS Usage Report useful for finding unencrypted objects?

No. AWS Usage Reports provide aggregate usage metrics (like storage size or request counts) but do not contain object-level metadata such as encryption status. S3 Inventory is required for this level of detail.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. OX_HDR 👍 9 Answered A
    A seems correct here. https://aws.amazon.com/blogs/storage/encrypting-objects-with-amazon-s3-batch-operations/
  2. BillaRanga 👍 8 Answered A
    S3 inventory list has "Encryption status" field so you can use this to filter the unencrypted objects. and use S3 batch to encrypt it with SSE-C key. AWS Usage report does not provide details about encryption status of individual objects
  3. mestule 👍 5 Answered A
    The solution must encrypt existing unencrypted objects. Batch will do that.
  4. LeonSauveterre 👍 1 Answered A
    As stated, "by using a customer-provided key", which rules out B & C. Option A uses 3 thingies: 1. S3 Inventory - Provides a native way to generate a list of unencrypted objects, making it scalable for millions of objects. 2. S3 Batch Operations - Encrypts existing objects efficiently. 3. S3 Default Encryption - Ensures future objects are automatically encrypted (with SSE-C).
  5. jaswantn 👍 1
    option B.... S3 Inventory report to check for unencrypted objects in s3 and then using Batch operation.
Show 3 more comments
  1. ike001 👍 2
    A is the answer
  2. Scheldon 👍 2 Answered A
    AnswerA
  3. Andy_09 👍 1
    Option B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide