Encrypting AWS Glue ETL with Customer-Specific CSE-KMS Keys?

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls. Determine high-performing data ingestion and transformation solutions.

Short answer

C Use one AWS Glue job per customer with a CSE-KMS security configuration, which encrypts data client-side before Amazon S3 with customer-specific keys.

Question

A medical company wants to perform transformations on a large amount of clinical trial data that comes from several customers. The company must extract the data from a relational database that contains the customer data. Then the company will transform the data by using a series of complex rules. The company will load the data to Amazon S3 when the transformations are complete. All data must be encrypted where it is processed before the company stores the data in Amazon S3. All data must be encrypted by using customer-specific keys. Which solution will meet these requirements with the LEAST amount of operational effort?
  1. Create one AWS Glue job for each customer. Attach a security configuration to each job that uses server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data.
  2. Create one Amazon EMR cluster for each customer. Attach a security configuration to each cluster that uses client-side encryption with a custom client-side root key (CSE-Custom) to encrypt the data.
  3. Create one AWS Glue job for each customer. Attach a security configuration to each job that uses client-side encryption with AWS KMS managed keys (CSE-KMS) to encrypt the data. Correct Answer
  4. Create one Amazon EMR cluster for each customer. Attach a security configuration to each cluster that uses server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the data.

Key Takeaways

This question tests the difference between client-side encryption during ETL and server-side encryption at rest in Amazon S3, and the operational trade-off between serverless AWS Glue and Amazon EMR; the trap is choosing SSE-S3 or SSE-KMS because they sound simpler but cannot encrypt data where it is processed with customer-specific keys.

AWS Glue jobs paired with client-side encryption using AWS KMS (CSE-KMS) security configurations let the medical company transform clinical trial data and encrypt it before loading it into Amazon S3 with customer-specific keys. This page confirms option C as the lowest-operational-effort solution and explains why the server-side SSE-S3 and SSE-KMS alternatives fail the encryption requirements.

Common mistake: Many candidates select option A because a single Glue job with an SSE-S3 security configuration looks operationally simple, but SSE-S3 uses Amazon S3-managed keys, so it neither encrypts the clinical trial data during Glue processing nor supports customer-specific keys.

Expert Analysis

Why the Answer Is Correct

Option C pairs serverless AWS Glue with a security configuration that enables client-side encryption using AWS KMS managed keys (CSE-KMS). CSE-KMS encrypts the clinical trial data inside the Glue job before any data is written to Amazon S3, satisfying the requirement that data be encrypted where it is processed. KMS customer managed keys can be customer-specific, so one Glue job per customer can use that customer's own key. Because Glue is serverless, there are no EMR clusters to provision, patch, scale, or secure, which directly addresses the least operational effort requirement. As TewatiaAmit noted, "AWS Glue with client-side encryption using AWS KMS (CSE-KMS)" provides the required pre-processing encryption with minimal operational effort.

Why the Other Options Are Wrong

Option A also uses Glue, but its security configuration selects SSE-S3, which is Amazon S3-managed server-side encryption; it does not encrypt data during Glue processing and cannot use customer-specific keys. Option B uses client-side encryption with CSE-Custom, but running one Amazon EMR cluster per customer means provisioning, tuning, patching, and securing each cluster, which is far more operational effort than Glue. Option D relies on SSE-KMS, which again is server-side encryption performed by Amazon S3 after the data is stored, not while the data is processed; the EMR-per-customer model adds the same cluster-management burden. None of A, B, or D satisfies both the "encrypted where processed" and "customer-specific keys" requirements with the least effort.

Community Comment Notes

The comment thread is essentially unanimous for C: sOI852POL summarized the solution as "AWS Glue for ETL, then AWS KMS (CSE-KMS)". blehbleh argued that Glue is required and that because encryption must happen before the company stores data in Amazon S3, "gotta be client side" — directly identifying the key distinction. FlyingHawk called C the best solution because it uses "AWS Glue for serverless ETL processing and CSE-KMS" with customer-specific keys. TewatiaAmit added that Glue with CSE-KMS provides the required pre-processing encryption with minimal operational effort. These comments align with the technical analysis above, but the vote count is not the reason to choose C; the wording of the encryption and operational-effort requirements is.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question says data must be encrypted "where it is processed" or "before it is stored" in S3, eliminate every SSE option because server-side encryption occurs in S3 after the ETL service writes the data. Then pick the serverless service—AWS Glue—instead of self-managed Amazon EMR to satisfy a least-operational-effort constraint.

Frequently Asked Questions

Why is SSE-S3 in option A insufficient for encrypted processing?

SSE-S3 uses Amazon S3-managed keys, not customer-controlled KMS keys, and it is server-side encryption applied in S3 after Glue writes the data, not while Glue processes it.

Can AWS Glue CSE-KMS use a different key for each customer?

Yes. A Glue security configuration can reference a customer managed KMS key ARN, so with one job per customer you can use a distinct KMS key for each customer's clinical trial data.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. blehbleh 👍 4 Answered C
    I say C, aws glue reduces the operational management uses server side encryption and ins which allows for user specific keys.
  2. blehbleh 👍 4 Answered C
    It’s C gotta use glue and since it’s before the company stores the data in Amazon S3 gotta be client side.
  3. sOI852POL 👍 4 Answered C
    AWS Glue for ETL, then AWS KMS (CSE-KMS)
  4. FlyingHawk 👍 3 Answered C
    Option C is the best solution because it uses AWS Glue for serverless ETL processing and CSE-KMS for end-to-end encryption using customer-specific keys
  5. TewatiaAmit 👍 2 Answered C
    AWS Glue with client-side encryption using AWS KMS (CSE-KMS) provides the required pre-processing encryption with minimal operational effort.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide