S3 Encryption with Automatic Key Rotation

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

B Create an AWS KMS customer managed key, enable automatic key rotation, and set the S3 bucket's default encryption to use this key.

Question

A company is planning to migrate data to an Amazon S3 bucket. The data must be encrypted at rest within the S3 bucket. The encryption key must be rotated automatically every year. Which solution will meet these requirements with the LEAST operational overhead?
  1. Migrate the data to the S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3). Use the built-in key rotation behavior of SSE-S3 encryption keys.
  2. Create an AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Set the S3 bucket's default encryption behavior to use the customer managed KMS key. Migrate the data to the S3 bucket. Correct Answer
  3. Create an AWS Key Management Service (AWS KMS) customer managed key. Set the S3 bucket's default encryption behavior to use the customer managed KMS key. Migrate the data to the S3 bucket. Manually rotate the KMS key every year.
  4. Use customer key material to encrypt the data. Migrate the data to the S3 bucket. Create an AWS Key Management Service (AWS KMS) key without key material. Import the customer key material into the KMS key. Enable automatic key rotation.

Key Takeaways

The exam tests the distinction between SSE-S3 and SSE-KMS regarding key rotation control. The common trap is choosing SSE-S3 for its simplicity while ignoring the specific requirement for annual rotation.

This question tests the configuration of Amazon S3 encryption to meet automatic annual key rotation requirements. The correct solution involves using AWS KMS customer-managed keys, which support explicit automatic rotation.

Common mistake: Candidates often choose Option A (SSE-S3) because it has the least operational overhead. However, SSE-S3 does not allow users to specify or control the rotation period, making it unsuitable for strict compliance policies requiring annual rotation.

Expert Analysis

Why the Answer Is Correct

Option B is the correct answer because it utilizes an AWS KMS customer-managed key with automatic rotation enabled. According to AWS documentation, enabling automatic rotation on a KMS key causes KMS to generate a new ciphertext-only copy of the key material every year (365 days). This meets the requirement for automatic annual rotation while still allowing S3 to use the key for server-side encryption.

Why the Other Options Are Wrong

Option A uses SSE-S3, where AWS manages the keys. While convenient, AWS does not expose the rotation schedule to customers, meaning you cannot guarantee or enforce the 'every year' constraint. Option C requires manual rotation, which violates the 'automatic' requirement and increases operational overhead. Option D involves importing external key material; however, AWS KMS does not support automatic rotation for keys with imported key material, as the system cannot rotate the underlying cryptographic material without breaking decryption.

Community Comment Notes

Community feedback strongly supports Option B. Many learners noted that SSE-S3 lacks the necessary control over rotation timing. As one user paraphrased, "SSE-S3 is out" when rotation is explicitly required. Another comment highlighted that "KMS will rotate key every 365days" if configured correctly, aligning with the prompt's constraints. Some initially chose A due to the 'least overhead' phrasing but were corrected by understanding that compliance requirements override general overhead considerations.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always read the specific constraints in the question carefully. If the question asks for 'automatic' rotation with a specific frequency (like 'every year'), SSE-S3 is incorrect because it hides the rotation details. Use KMS Customer-Managed Keys when you need control over key lifecycle policies.

Frequently Asked Questions

Why can't I use SSE-S3 for automatic rotation?

SSE-S3 rotates keys automatically, but AWS does not disclose the rotation schedule or allow you to enforce a specific frequency like 'every year'. KMS CMKs allow you to enable explicit annual rotation.

Can I rotate KMS keys with imported material automatically?

No. If you import your own key material into a KMS key, you must manage the rotation manually. Automatic rotation is only supported for KMS keys where AWS generates the key material.

More SAA-C03 FAQ →

Community Votes

B
73%
A
27%

73% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 17 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 17

  1. Scheldon 👍 3 Answered B
    AnswerB Looks like key rotation is only possible when KMS is in use. If we will use AWS managed keys Rotation is forced and if we will not provide any specifications regarding rotation time for key, KMS will rotate key every 365days. https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-mgmt
  2. JoeTromundo 👍 3 Answered B
    The anwser can't be A. In addition to other justifications written here in the comments, if the data is copied before enabling encryption, this data will not be encrypted.
  3. f07ed8f 👍 3 Answered B
    SSE-S3 does not rotate the key EVERY YEAR and it is not fit the requirement
  4. sheilawu 👍 3 Answered B
    If you see rotation, SEE-SE is out
  5. TwinSpark 👍 2 Answered B
    I will go for B. A it's somehow wrong for coupl of reason: 1- Encription must be specified before to transfer the data (even if from 1/23 it's automatically for every bucket, so actualy make no sense to specify it) 2- SSE-S3 keys are regurarly rotated but aws do not specify when (https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html ) IMO if need to be compliance with rotation period better use Costumer managed key as stated from aws support in 01/2024 https://repost.aws/questions/QUES_1VN01TU-eRSO3LXergA/s3-managed-key-sse-s3-rotation-period
Show 12 more comments
  1. Linuslin 👍 2 Answered A
    This question is flawed. SSE-S3 is not SSE-KMS, so it will not automatic rotation every year, only KMS will. (check link below) But the question says "LEAST operational overhead", I think it want us to choose SSE-S3, so I will pick option A.
  2. EllenLiu 👍 2 Answered B
    https://repost.aws/questions/QUES_1VN01TU-eRSO3LXergA/s3-managed-key-sse-s3-rotation-period
  3. n999 👍 2 Answered A
    It's said should be encrypted within S3 not before so A its correct
  4. TruthWS 👍 2
    A is correct because SSE-S3 help decrease the management
  5. sandordini 👍 2 Answered A
    From May 2022 the scheduled rotation is 1 year (SSE-S3)
  6. bujuman 👍 1 Answered A
    Considering the statement "the LEAST operational overhead" we could go for option A due to the following AWS managed keys capabilities https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys
  7. 3b196fc 👍 1
    A is wrong because you need to set the encryp options before send the data to S3.
  8. haci 👍 1
    Same with Question #202, I'll go with B but not sure
  9. Yushib 👍 2 Answered B
    B is the right one
  10. Johnoppong101 👍 1 Answered B
    B is the Answer
  11. f04dc74 👍 1
    Option A
  12. camps 👍 1
    It's B.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide