What should a solutions architect recommend to satisfy these requirements?
Server-side encryption with customer-provided encryption keys
Client-side encryption with Amazon S3 managed encryption keys
Server-side encryption with keys stored in AWS key Management Service (AWS KMS)
Client-side encryption with a master key stored in AWS Key Management Service (AWS KMS)
Explanations:
Server-side encryption with customer-provided keys (SSE-C) encrypts data on AWS side, not before sending, which fails to meet the requirement for pre-encryption.
Client-side encryption with Amazon S3 managed keys does not fulfill the requirement, as Amazon S3 managed keys handle encryption on the server side, not on the client side.
Server-side encryption with AWS KMS also encrypts data after it reaches Amazon S3, rather than encrypting it before sending, which does not meet the requirement.
Client-side encryption with a master key stored in AWS KMS ensures encryption is handled by the client before data is transmitted to S3, fully satisfying the security compliance requirements.
In my opinion, the answer is:
Client-side encryption with a master key stored in AWS Key Management Service (AWS KMS)
I systematize that the answer is:
Client-side encryption with a master key stored in AWS Key Management Service (AWS KMS)