S3 Server-Side Encryption with Customer-Specific KMS Keys

SAA-C03 By islever Editorial Last updated Oct 11, 2026

Determine appropriate data security controls.

Short answer

C Provision a separate AWS KMS key for each customer, encrypt server-side, and deny decryption in the KMS key policy for all except the customer's IAM role.

Question

A company needs to provide customers with secure access to its data. The company processes customer data and stores the results in an Amazon S3 bucket. All the data is subject to strong regulations and security requirements. The data must be encrypted at rest. Each customer must be able to access only their data from their AWS account. Company employees must not be able to access the data. Which solution will meet these requirements?

Provision an AWS Certificate Manager (ACM) certificate for each customer. Encrypt the data client-side. In the private certificate policy, deny access to the certificate for all principals except an IAM role that the customer provides.
Provision a separate AWS Key Management Service (AWS KMS) key for each customer. Encrypt the data server-side. In the S3 bucket policy, deny decryption of data for all principals except an IAM role that the customer provides.
Provision a separate AWS Key Management Service (AWS KMS) key for each customer. Encrypt the data server-side. In each KMS key policy, deny decryption of data for all principals except an IAM role that the customer provides. Correct Answer
Provision an AWS Certificate Manager (ACM) certificate for each customer. Encrypt the data client-side. In the public certificate policy, deny access to the certificate for all principals except an IAM role that the customer provides.

Key Takeaways

The core concept is that while S3 bucket policies control object access, KMS key policies control the cryptographic operations (decrypt/encrypt); therefore, isolation requires restricting the KMS key policy, not just the bucket policy.

This question tests the correct configuration for encrypting Amazon S3 data at rest using separate AWS KMS keys per customer. The page establishes that access control must be enforced via KMS key policies to ensure strict isolation between customers.

Common mistake: Many learners choose Option B because they focus on S3 bucket policies for access control. However, a bucket policy cannot prevent decryption if the IAM role has permission to use the KMS key; the restriction must happen at the key level.

Expert Analysis

Why the Answer Is Correct

Option C is the correct solution because it utilizes Server-Side Encryption with AWS Key Management Service (SSE-KMS) and enforces strict isolation through the KMS key policy. Since each customer gets a separate KMS key, modifying the key policy to deny all principals except the specific customer's IAM role ensures that only authorized entities can perform the kms:Decrypt operation. This creates a cryptographic boundary that prevents employees or other customers from accessing the data, even if they somehow gain S3 object permissions.

Why the Other Options Are Wrong

Options A and D are incorrect because AWS Certificate Manager (ACM) is used for securing data in transit (TLS/SSL), not for encrypting data at rest. Option B is incorrect because it relies on the S3 bucket policy to deny decryption. While a bucket policy can deny s3:GetObject, it cannot deny the underlying KMS Decrypt action if the principal has KMS permissions. To truly isolate the data cryptographically, the KMS key itself must deny access to unauthorized principals.

Community Comment Notes

Community consensus strongly supports Option C. As user mohammadthainat noted, "Encryption at rest --> KMS Each customer must be able to access only their data --> KMS Key Policies." User tch reinforced this by stating, "A key policy is a resource policy for an AWS KMS key... The statements in the key policy determine who has permission to use the KMS key." Some users like BBR01 questioned the phrasing but agreed C is the intended logic regarding key policies.

Official Reference

https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always distinguish between encryption in transit (ACM/SSL) and encryption at rest (SSE-KMS/SSE-S3). When multi-tenancy or strict data isolation is required, ensure you restrict permissions at the KMS key level, not just the storage service level.

Frequently Asked Questions

Why doesn't an S3 bucket policy suffice for data isolation?

A bucket policy controls object access (GetObject) but cannot stop a user with KMS permissions from decrypting the data. You must restrict the KMS key usage directly.

Is ACM suitable for encrypting data at rest in S3?

No. ACM manages certificates for TLS/HTTPS (data in transit). For data at rest, use SSE-KMS or SSE-S3.

More SAA-C03 FAQ →

Community Votes

75%

25%

75% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

Cali182 👍 4 Answered C

Option C From Chapt Option A is incorrect because using ACM certificates is typically for establishing secure communication over HTTPS and doesn't directly relate to encrypting data at rest in S3. Option B is incorrect because while it suggests using AWS KMS keys for encryption, it mentions using S3 bucket policies for access control, which would not be appropriate for controlling decryption permissions. Option D is incorrect because it suggests using ACM certificates for client-side encryption, which is not typically used for encrypting data at rest in S3, and the approach described would not effectively control access to the encrypted data.
BBR01 👍 4 Answered C

Actually I think neither B or C is correctly worded. If talking about key policy, should be "Modify the key's policy to grant the IAM user permissions for the kms:GenerateDataKey and kms:Decrypt actions at minimum." If talking about bucket policy, should be "Deny GetObjects of particular customer without condition kms key equals 1234abcd...."
mohammadthainat 👍 4 Answered C

Encryption at rest --> KMS Each customer must be able to access only their data --> KMS Key Policies
Neung983 👍 3 Answered B

B. Here's why this option is the best fit: Server-Side Encryption: Encrypting data server-side with KMS ensures encryption happens transparently within AWS, eliminating the need for complex client-side management and potential security risks associated with user-managed keys. Customer-Specific Keys: Utilizing separate KMS keys for each customer provides granular access control and encryption isolation. Each customer can only decrypt their data using their specific KMS key. S3 Bucket Policy: By denying decryption permissions for all principals except the dedicated customer IAM role in the S3 bucket policy, unauthorized access, even from company employees, is prevented. This aligns with the requirement of customer-specific data access.
LeonSauveterre 👍 2 Answered B

ACM certificates are for securing communication (e.g., HTTPS/SSL), not for encrypting data at rest in S3. A and D are out. Between B and C, they both create a separate key for each customer, and both work. So which is more cumbersome, managing S3 policies or managing KMS key policies? Of course the latter one. In B, S3 bucket policy centralizes access rules for all keys, while in C, policies are distributed across individual keys. That's why I decide to choose B.

Show 3 more comments

tch 👍 1 Answered C

A key policy is a resource policy for an AWS KMS key. Key policies are the primary way to control access to KMS keys. Every KMS key must have exactly one key policy. The statements in the key policy determine who has permission to use the KMS key and how they can use it.
Andy_09 👍 3

Correct answer should be C
RC6 👍 2 Answered C

C looks correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide