QuestionQ325

Data Security and Governance

A company requires a solution that restricts access to Amazon S3 data, encrypts that data by using AWS managed keys, manages database credentials used by an AWS Lambda function, and automatically rotates those credentials.

Which solution meets these requirements?

  • A Use S3 bucket policies to control access. Use server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data. Store the database credentials as Lambda environment variables.
  • B Use IAM policies to control access. Use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the data. Configure AWS Secrets Manager to store and automatically rotate the credentials by using a Lambda function.
  • C Use S3 ACLs to control access. Use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the data. Store the credentials in AWS Systems Manager Parameter Store and automatically rotate the credentials by using a Lambda function.
  • D Use IAM policies to control access. Use server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data. Store the credentials in AWS Systems Manager Parameter Store. Configure a scheduled Lambda function to rotate the credentials.
Explanation

IAM policies can restrict access to Amazon S3 resources. Amazon S3 SSE-KMS supports use of an AWS managed KMS key, and AWS Secrets Manager securely stores database credentials and performs automatic rotation through a configured Lambda rotation function.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!