Minimizing Cost for Automated S3 Key Rotation

SAA-C03 By islever Editorial Last updated

Design cost-optimized storage solutions. Determine appropriate data security controls.

Short answer

C Use server-side encryption with AWS KMS keys (specifically AWS managed keys) to achieve automatic rotation and CloudTrail tracking with no monthly fee.

Question

A company regularly uploads confidential data to Amazon S3 buckets for analysis. The company's security policies mandate that the objects must be encrypted at rest. The company must automatically rotate the encryption key every year. The company must be able to track key rotation by using AWS CloudTrail. The company also must minimize costs for the encryption key. Which solution will meet these requirements?
  1. Use server-side encryption with customer-provided keys (SSE-C)
  2. Use server-side encryption with Amazon S3 managed keys (SSE-S3)
  3. Use server-side encryption with AWS KMS keys (SSE-KMS) Correct Answer
  4. Use server-side encryption with customer managed AWS KMS keys

Key Takeaways

The question tests the ability to distinguish between AWS-managed and Customer-managed KMS keys based on cost constraints while maintaining compliance with automatic rotation requirements.

AWS managed KMS keys provide automatic annual rotation and CloudTrail logging without monthly fees, making them the most cost-effective solution compared to customer-managed keys.

Common mistake: Choosing Option D because candidates assume 'automatically' implies a specific custom policy rather than the service's default behavior, ignoring the significant monthly cost of CMKs.

Expert Analysis

Why the Answer Is Correct

Option C is correct because AWS managed keys (aws/s3) are automatically rotated every year by AWS, satisfying the rotation requirement without any user intervention. Crucially, they incur no monthly fee, only a per-request charge, which aligns with the goal to minimize costs. As noted by community members, "There is no monthly fee for AWS managed keys". The rotation events are logged in CloudTrail, allowing the company to track key rotations as required.

Why the Other Options Are Wrong

Option A (SSE-C) requires the customer to manage key material and rotation manually, violating the automation requirement. Option B (SSE-S3) uses S3 managed keys which do not support CloudTrail logging for key usage or rotation events. Option D (Customer Managed Keys) incurs a $1/month fee plus per-request charges, failing the cost minimization constraint compared to the free AWS managed option.

Community Comment Notes

Several users correctly identified that the lack of a monthly fee makes Option C superior for cost optimization. User nebajp highlighted that SSE-CMKS have usage fees but no monthly charges, contrasting with D. User FlyingHawk emphasized that AWS managed keys are automatically rotated and log to EventBridge/CloudTrail. Some users like Dantecito argued for D, suggesting 'automatically' might imply user-defined policies, but the standard interpretation in this context favors the zero-cost default service behavior.

Official Reference

https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked to minimize costs for encryption, always consider AWS managed keys first if they meet security requirements. Only choose Customer Managed Keys if you need specific controls like custom rotation schedules or cross-account permissions that AWS managed keys cannot provide.

Frequently Asked Questions

Does AWS automatically rotate SSE-S3 keys?

No, SSE-S3 uses keys managed entirely by S3 and does not expose key rotation details or logs to CloudTrail. You cannot track or control the rotation process.

Why is Option D more expensive than C?

Customer Managed Keys (CMKs) incur a monthly fee of approximately $1 per key regardless of usage, whereas AWS Managed Keys have no monthly fee, only per-API request charges.

More SAA-C03 FAQ →

Community Votes

C
65%
D
35%

65% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 16 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 16

  1. nebajp 👍 9 Answered C
    SSE keys provided usage fee application and there is no monthly charges, hence its a correct option. D is highly cost option with monthly and usage fee. which is incorrect.
  2. elmyth 👍 4 Answered C
    Customer managed key: Monthly fee (pro-rated hourly) + Per-use fee + rotation and cloudtrail AWS managed key: No monthly fee + Per-use fee (some AWS services pay this fee for you)+ rotation and cloudtrail
  3. sOI852POL 👍 3 Answered C
    Answer is C. There is no monthly fee for AWS managed keys https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk
  4. FlyingHawk 👍 2 Answered C
    AWS-managed keys are automatically rotated every year (approximately 365 days) by AWS. Key rotation cannot be enabled or disabled for AWS-managed keys, ensuring compliance with the rotation requirement. When AWS KMS rotates the key material for an AWS-managed key, it writes: A KMS CMK Rotation event to Amazon EventBridge, A RotateKey event to AWS CloudTrail. This allows the company to track key rotation events for auditing purposes. Cost Minimization:AWS-managed keys are free to use (no additional cost beyond the base AWS KMS pricing for API calls). This helps minimize costs. https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html
  5. Dantecito 👍 2 Answered D
    C. since May 2022 managed SSE-KMS can rotate every year https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html D. I still prefer D because the question says "The company must automatically rotate the encryption key every year" it does not say "AWS must automatically..."
Show 11 more comments
  1. dhewa 👍 2 Answered D
    D gives you control, allows you to customise for example rotation policies to suit your compliance needs.
  2. joanna91 👍 2 Answered C
    "Automatically" rotate, then make it handled by AWS service, not by customer -> C, not D
  3. Anyio 👍 1 Answered D
    Option C: Incorrect. Though server-side encryption with AWS KMS keys (SSE-KMS) would allow AWS to manage keys and enable logging via AWS CloudTrail, this option uses AWS-managed keys instead of customer-managed keys, limiting control over key rotations. Additionally, there can be more costs involved in using AWS-managed KMS keys compared to the customer managing their own. Option D: Correct. Using server-side encryption with customer-managed AWS KMS keys allows the company to have full control over the encryption keys, including managing and ensuring automatic rotation every year. Moreover, AWS CloudTrail can be employed to log events associated with AWS KMS, enabling the tracking of when keys are rotated. This option balances cost-effectiveness with the operational requirements specified, as it provides the necessary control without unnecessary expenses from more specialized AWS services.
  4. GOTJ 👍 1 Answered C
    With all due respect, I think option "C" is poorly written, and it reflects on the lack of consensus with this one. A "server-side encryption with customer managed AWS KMS keys" (option "D") is nothing but an implementation of a "server-side encryption with AWS KMS keys" (option "C"), and both are SSE-KMS. What I think op tried to express with option C is: "Use server-side encryption with AWS-MANAGED AWS KMS keys (SSE-KMS). If my guess is correct, option "C" is the right answer, according to the table shown in this link: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk Option C and Option D satisfied all the technical requirements of the company, but option C is $1/month cheaper than option D
  5. JA2018 👍 1 Answered D
    I will choose Option D for the following reasons: #1 Automatic key rotation: AWS KMS allows you to set up automatic key rotation for customer managed keys, which fulfills the requirement to rotate encryption keys yearly. # 2 CloudTrail tracking: All KMS key operations are logged in CloudTrail, enabling you to track key rotation activity. #3 Lowest cost: While using customer-provided keys (SSE-C) might seem cost-effective at first glance, managing your own keys adds complexity and can be more expensive in the long run. #$ Compliance with security policies: Using customer managed KMS keys ensures that the company has full control over the encryption keys, meeting the stringent security requirements
  6. yangbo 👍 1 Answered D
    "SSE-KMS (AWS managed KMS keys): Automatically rotated, but the rotation records are not visible. Users cannot view the RotateKey event in CloudTrail."
  7. tch 👍 1 Answered C
    should put full name as "Use server-side encryption with AWS KMS managed keys" answer D does not minimize the cost
  8. LeonSauveterre 👍 1 Answered D
    "automatically rotate the encryption key" => C or D (because of KMS), then "able to track key rotation" => Just D.
  9. XXXXXlNN 👍 1
    D. customer needs to see the logs from Cloudtrail!
  10. XXXXXlNN 👍 1
    D auto-rotation feature > customer managed key
  11. komorebi 👍 4 Answered D
    Answer is D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide