A company is building an application in the AWS Cloud. The application will store data in Amazon S3 buckets in two AWS Regions. The company must use an AWS Key Management Service (AWS KMS) customer managed key to encrypt all data that is stored in the S3 buckets. The data in both S3 buckets must be encrypted and decrypted with the same KMS key. The data and the key must be stored in each of the two Regions.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an S3 bucket in each Region. Configure the S3 buckets to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Configure replication between the S3 buckets.
B. Create a customer managed multi-Region KMS key. Create an S3 bucket in each Region. Configure replication between the S3 buckets. Configure the application to use the KMS key with client-side encryption.
C. Create a customer managed KMS key and an S3 bucket in each Region. Configure the S3 buckets to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Configure replication between the S3 buckets.
D. Create a customer managed KMS key and an S3 bucket in each Region. Configure the S3 buckets to use server-side encryption with AWS KMS keys (SSE-KMS). Configure replication between the S3 buckets.
The solution that meets the requirements with the LEAST operational overhead is:
B. Create a customer managed multi-Region KMS key. Create an S3 bucket in each Region. Configure replication between the S3 buckets. Configure the application to use the KMS key with client-side encryption.
Here’s why:
Customer Managed Multi-Region KMS Key: This option uses a single customer managed KMS key that is designed to work across multiple AWS Regions. This means you don’t have to manage separate keys for each Region, reducing operational overhead.
S3 Buckets in Each Region: It creates an S3 bucket in each Region, which is necessary for storing data in two AWS Regions.
Replication: It configures replication between the S3 buckets. This ensures that data is synchronized across the two Regions, which is a requirement in this scenario.
Client-Side Encryption with KMS Key: The application is configured to use the KMS key with client-side encryption. This means the application handles the encryption and decryption process using the specified KMS key.
Option A is not suitable because it uses Amazon S3 managed encryption keys (SSE-S3) which means AWS handles the encryption, but you require customer managed keys for your specific needs.
Option C is similar to Option A, using SSE-S3, and doesn’t involve customer managed keys, which is a requirement in this scenario.
Option D uses SSE-KMS, which would require managing separate KMS keys in each Region, increasing operational overhead.
Therefore, option B is the most suitable and least operationally intensive solution for this scenario.