How do you implement this in a highly available and cost-efficient way?
Manage encryption keys on-premises in an encrypted relational database. Set up an on-premises server with sufficient storage to temporarily store files, and then upload them to Amazon S3, providing a client-side master key.
Mange encryption keys in a Hardware Security Module (HSM) appliance on-premises serve r with sufficient storage to temporarily store, encrypt, and upload files directly into Amazon Glacier.
Manage encryption keys in Amazon Key Management Service (KMS), upload to Amazon Simple Storage Service (S3) with client-side encryption using a KMS customer master key ID, and configure Amazon S3 lifecycle policies to store each object using the Amazon Glacier storage tier.
Manage encryption keys in an AWS CloudHSM appliance. Encrypt files prior to uploading on the employee desktop, and then upload directly into Amazon Glacier.
Explanations:
While managing encryption keys on-premises and using a server to temporarily store files is a possible approach, it introduces risks such as potential data loss if the server fails, and it does not utilize AWS’s services for efficiency. Additionally, this method does not automatically provide high availability or scalability.
Managing encryption keys in a Hardware Security Module (HSM) is secure, but the use of an on-premises server to encrypt and upload files directly to Amazon Glacier could create challenges in availability and scalability. Furthermore, Glacier is designed for long-term archival and retrieval may not be as efficient compared to S3.
Managing encryption keys in AWS Key Management Service (KMS) leverages AWS’s secure infrastructure for key management. Using client-side encryption with a KMS customer master key ID ensures that data is encrypted before being sent to S3. Additionally, setting up lifecycle policies to transition data to Glacier optimizes cost and storage management while maintaining high availability and compliance with regulatory requirements.
Using an AWS CloudHSM for key management is a secure option, but encrypting files on the employee desktop may complicate the process for users and create inconsistencies in encryption practices. Uploading directly to Glacier may lead to longer retrieval times and is not as efficient for frequent access compared to using S3 first.
I judge that the answer is:
Manage encryption keys in Amazon Key Management Service (KMS), upload to Amazon Simple Storage Service (S3) with client-side encryption using a KMS customer master key ID, and configure Amazon S3 lifecycle policies to store each object using the Amazon Glacier storage tier.