Encrypting S3 Archival Data Before Upload to AWS?

SAA-C03 By islever Editorial Last updated Oct 14, 2026

Determine appropriate data security controls.

Short answer

D Configure the application to use client-side encryption with an AWS KMS key so that archival files are encrypted before they are sent to Amazon S3.

Question

A company runs an application in the AWS Cloud that generates sensitive archival data files. The company wants to rearchitect the application's data storage. The company wants to encrypt the data files and to ensure that third parties do not have access to the data before the data is encrypted and sent to AWS. The company has already created an Amazon S3 bucket. Which solution will meet these requirements?

Configure the S3 bucket to use client-side encryption with an Amazon S3 managed encryption key. Configure the application to use the S3 bucket to store the archival files.
Configure the S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS). Configure the application to use the S3 bucket to store the archival files.
Configure the S3 bucket to use dual-layer server-side encryption with AWS KMS keys (SSE-KMS). Configure the application to use the S3 bucket to store the archival files.
Configure the application to use client-side encryption with a key stored in AWS Key Management Service (AWS KMS). Configure the application to store the archival files in the S3 bucket. Correct Answer

Key Takeaways

The exam tests the distinction between client-side and server-side encryption; the trap is treating SSE-KMS or SSE-S3 as satisfying a requirement to encrypt data before it is sent to AWS.

This SAA-C03 question tests how to encrypt sensitive archival files before they are sent to Amazon S3. It establishes that client-side encryption with an AWS KMS key (option D) is required, because server-side encryption leaves plaintext exposed until S3 receives it.

Common mistake: Many candidates pick server-side SSE-KMS (B or C) because it sounds strong, but server-side encryption happens only after the object reaches S3; option A is also wrong because it calls an S3 managed key 'client-side' when that key is actually SSE-S3.

Expert Analysis

Why the Answer Is Correct

Option D is the only choice that performs encryption inside the application before the archival files leave the company's control. By using client-side encryption with an AWS KMS key, the application encrypts the data locally and uploads only ciphertext to the existing S3 bucket. This directly satisfies the need to keep third parties from accessing readable data before the data is encrypted and transmitted. AWS KMS supplies and protects the key material, but the plaintext is never exposed to S3 or any other third party.

Why the Other Options Are Wrong

Option A is internally inconsistent: an Amazon S3 managed encryption key is used for SSE-S3, which is server-side encryption, not client-side encryption. Options B and C both use server-side encryption (SSE-KMS and dual-layer SSE-KMS), which means Amazon S3 encrypts the object only after it receives the plaintext. Although SSE-KMS and DSSE-KMS protect data at rest in S3, they do not stop third parties from accessing the data before it is encrypted and sent to AWS. Therefore, B and C fail the core requirement of encrypting data before upload.

Community Comment Notes

Learner xBUGx focused on the exact requirement, quoting "ensure that third parties do not have access to the data before the data is encrypted and sent to AWS." Another commenter, f07ed8f8, correctly noted that an "Amazon S3 managed encryption key" (SSE-S3) is server-side encryption, so it cannot be client-side encryption. Hkayne reinforced that the data must "encrypt on client side before uploading it to S3." All visible votes selected D, which aligns with the official AWS client-side encryption model.

Official Reference

https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Look for the phrase 'before the data is encrypted' or 'before it is sent to AWS' — that wording signals client-side encryption. Eliminate any option using SSE-S3, SSE-KMS, or DSSE-KMS because those are server-side and encrypt only after upload.

Frequently Asked Questions

Why is SSE-KMS not enough to encrypt data before it is sent to AWS?

SSE-KMS encrypts objects only after they arrive at Amazon S3, so the plaintext reaches AWS first. The requirement demands encryption before transmission, which only client-side encryption provides.

Can an S3 managed encryption key be used for client-side encryption?

No. An S3 managed key (SSE-S3) is a server-side encryption key managed by AWS; client-side encryption must use a key the application controls, such as an AWS KMS key.

More SAA-C03 FAQ →

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

xBUGx 👍 8 Answered D

"ensure that third parties do not have access to the data before the data is encrypted and sent to AWS"
f07ed8f 👍 6 Answered D

"Amazon S3 managed encryption key" (SSE-S3) is a server-side encryption. Therefore it is not a client-side encryption. To encrypt the data before sending to S3, it has to be client-side encryption.
Hkayne 👍 3 Answered D

Must encrypt the data on client side before uploading it to S3

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide