Achieving Data Encryption in Transit for AWS S3
Question
You work at a company that makes use of AWS resources.
One of the key security policies is to ensure that all data is encrypted in transit in AWS.
Which of the following options can help you achieve the requirement for S3?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Answer -A.
Option A is CORRECT because SSL/TLS should be used for the encryption in-transit for S3 buckets.
AWS SDKs or CLI use SSL/TLS by default.
Option B is incorrect because SSE-S3 is a server-side encryption method instead of the client-side.
Option C is incorrect because server-side encryption does not help with the encryption in transit.
Option D is incorrect because bucket policy should be used instead of bucket ACL.
For more information on how to protect S3 data using encryption, please visit the below URL:
https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.htmlThe correct answer is A. Use AWS SDKs or CLI to upload objects to S3 buckets via Secure Socket Layer/Transport Layer Security (SSL/TLS).
Explanation: AWS S3 provides several options for encrypting data at rest and in transit. To meet the requirement of encrypting data in transit, SSL/TLS is a common option. SSL/TLS is a protocol that provides secure communication between two devices by encrypting the data being transmitted. S3 supports SSL/TLS for all data in transit, including uploads and downloads.
Option B: SSE-S3 (Server-Side Encryption with Amazon S3-Managed Keys) is a method of encrypting data at rest, not in transit. SSE-S3 encrypts data by default when it is written to S3 and decrypts it when it is retrieved. Therefore, it is not applicable to the requirement of encrypting data in transit.
Option C: SSE-KMS (Server-Side Encryption with AWS KMS-Managed Keys) is another method of encrypting data at rest, not in transit. SSE-KMS uses AWS Key Management Service (KMS) to manage and protect the encryption keys, but it does not provide encryption during data transmission.
Option D: Modifying the bucket Access Control List (ACL) to only allow SSL connections is not a recommended approach for encrypting data in transit. While it can help enforce secure communication between devices, it does not provide actual encryption for the data being transmitted. Therefore, it is not a suitable solution for meeting the requirement of encrypting data in transit.
In summary, the best option to achieve the requirement of encrypting data in transit for S3 is to use AWS SDKs or CLI to upload objects to S3 buckets via SSL/TLS.
