Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Associate · AWS
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
C. Create bucket policies that require the use of server-side encryption with S3 managed encryption keys (SSE-S3) for S3 uploads. Ensures all uploaded objects are encrypted at rest with SSE-S3. Can also enforce HTTPS (in-transit encryption) by adding a bucket policy denying non-SSL requests (aws:SecureTransport: false). Enforces encryption automatically and centrally, with minimal operational overhead. While encryption happens after upload, this is the standard AWS best practice for at-rest encryption and policy enforcement. Best practical and enforceable approach.
For those who are confused with the data also must be encrypted in transit, Amazon S3 TLS (Transport Layer Security) is used by default and you can't disable it.
After a little googling, for those who are confused by "at rest": 1. *Encryption at Rest* refers to the encryption applied to the stored data. Encryption may be implemented at the source, where data is generated and stored at the origin. 2. *Encryption in Transit* refers to encrypting data that is transferred between two nodes of the network. 3. *End-to-End Encryption* refers to the combination of the encryption at rest and encryption in transit.