Which of the following architectures will meet these requirements?
(Choose two.)
Use Amazon S3 server-side encryption with Amazon S3-managed keys. Allow Amazon S3 to generate an AWS/S3 master key, and use IAM to control access to the data keys that are generated.
Use Amazon S3 server-side encryption with AWS KMS-managed keys, create multiple customer master keys, and use key policies to control access to them.
Use Amazon S3 server-side encryption with customer-managed keys, and use AWS CloudHSM to manage the keys. Use CloudHSM client software to control access to the keys that are generated.
Use Amazon S3 server-side encryption with customer-managed keys, and use two AWS CloudHSM instances configured in high-availability mode to manage the keys. Use the CloudHSM client software to control access to the keys that are generated.
Use Amazon S3 server-side encryption with customer-managed keys, and use two AWS CloudHSM instances configured in high-availability mode to manage the keys. Use IAM to control access to the keys that are generated in CloudHSM.
Explanations:
While S3 server-side encryption with S3-managed keys (SSE-S3) encrypts data at rest, it does not provide per-user control over encryption keys. S3 manages the keys, and access control is limited to object-level permissions using IAM. This does not meet the requirement of different users having access to different encryption keys.
Using S3 server-side encryption with AWS KMS-managed keys (SSE-KMS) allows the creation of multiple customer master keys (CMKs). Key policies on these CMKs can then be used to grant fine-grained access to individual keys, meeting the requirement of per-user key control. KMS provides high availability for the keys.
While using CloudHSM for key management provides strong security and customer control, using the CloudHSM client software directly to control access to generated keys for S3 encryption is not the standard or recommended approach. CloudHSM is typically integrated with KMS, which then handles the encryption operations for S3. Directly managing keys with the CloudHSM client adds significant complexity without a corresponding increase in security for this use case.
This is similar to option C but adds high availability for the CloudHSM cluster, which is a good practice. However, like C, using the CloudHSM client software directly is not the recommended integration method with S3. It is still valid because it meets the requirements of key management and high availability and per user access control.
You cannot directly use IAM to control access to keys generatedwithinCloudHSM. CloudHSM has its own user and key management system. While you can use IAM to control access to the CloudHSMclusteritself (for administrative tasks), you cannot use IAM to control access to individual keys stored within the HSMs for S3 encryption. KMS is the service that integrates IAM with customer managed keys for S3 encryption.