Examkin

Question

Difficulty: MediumData Protection and Encryption

A digital art platform stores high-resolution images in an Amazon S3 bucket. The platform's compliance team requires all stored images to be encrypted at rest. The platform wants a fully managed solution where AWS handles the maintenance, clustering, and scaling of the underlying hardware security modules (HSMs), while the customer manages access policies for the encryption keys. Which AWS service should the platform use to meet this requirement?

  1. A
    AWS CloudHSM
  2. B
    AWS Secrets Manager
  3. AWS Key Management Service (AWS KMS)Answer
  4. D
    AWS Artifact

Answer

AWS Key Management Service (AWS KMS)
AWS Key Management Service (AWS KMS) is a fully managed service that allows customers to create, manage, and control cryptographic keys. With AWS KMS, AWS manages the underlying hardware security modules (HSMs) for operations such as maintenance, clustering, and scaling, while the customer remains responsible for key access policies and key usage, satisfying the requirement for a fully managed key storage solution.

Step-by-Step Solution

1
Identify the primary requirement of the scenario.
The platform needs to encrypt S3 data at rest using a managed key service where AWS maintains the physical hardware security modules (HSMs) and the customer manages access control.
Defining the technical requirements helps narrow down the service options between fully managed key management and dedicated hardware modules.
2
Compare AWS Key Management Service (AWS KMS) and AWS CloudHSM.
AWS KMS is a multi-tenant, fully managed service where AWS manages HSM provisioning and scaling. AWS CloudHSM is a single-tenant, dedicated HSM service where the customer is responsible for HSM cluster management and administration.
Distinguishing between managed services and dedicated hardware modules determines which service meets the operational and compliance constraints of the platform.

Key Concept

AWS Key Management Service (AWS KMS) vs AWS CloudHSM and Shared Responsibility for Data Protection
Rate this question

Topics

Data Protection and Encryption

More questions from this topic