A healthcare provider plans to build a patient portal on AWS. The portal will run on Amazon EC2 instances and store sensitive medical imaging files in an Amazon S3 bucket. Compliance regulations require all data to be encrypted both at rest and in transit.
Which of the following actions are the responsibility of the customer to ensure data protection under the AWS Shared Responsibility Model? (Select TWO.)
- Enabling SSL/TLS (HTTPS) for data transmission between the EC2 instances and the S3 bucket to protect data in transitAnswer
- Defining key policies for AWS Key Management Service (AWS KMS) customer managed keys to control access for encryption at restAnswer
- CManaging the physical security and environmental controls of the facilities housing the KMS hardware security modules (HSMs)
- DDeploying and managing dedicated physical single-tenant HSM appliances for standard AWS KMS keys
- EPatching and upgrading the hypervisor and host operating systems that perform S3 server-side encryption
Answer
Enabling SSL/TLS (HTTPS) for data transmission between the EC2 instances and the S3 bucket to protect data in transit, and defining key policies for AWS Key Management Service (AWS KMS) customer managed keys to control access for encryption at rest
The correct actions are configuring SSL/TLS (HTTPS) for data in transit and defining key policies for AWS KMS customer managed keys. Under the AWS Shared Responsibility Model, the customer is responsible for 'security in the cloud,' which includes encrypting their own data in transit (by using HTTPS protocols) and managing access control to their encryption keys (via key policies).
Step-by-Step Solution
Key Concept
Under the AWS Shared Responsibility Model, AWS manages security 'of' the cloud (including physical security, hypervisors, and managed service infrastructure), while the customer manages security 'in' the cloud (including configuring secure transport protocols, managing encryption keys, and defining key policies).