Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 681 discussion

"Able to control rotation of the encryption keys" = customer managed key (created by AWS but managed by the customer in KMS)

The company must be able to control rotation of the encryption keys = customer managed key

The company must ensure encryption at rest using AWS KMS and must control key rotation with minimal operational overhead. AWS Managed Keys are automatically managed by AWS, including automatic key rotation every year. This approach eliminates manual key management, reducing administrative effort.

"The company must be able to control rotation of the encryption keys." BD does not allow company owned keys C is too much operational overhead

The solution that meets the requirements with the LEAST operational overhead is: B. Use an AWS managed key to encrypt the EBS volumes. Use the key to configure automatic key rotation. With AWS managed keys (AWS managed CMKs), AWS takes care of key management tasks, including key rotation. This reduces operational overhead as AWS automatically handles key rotation without requiring manual intervention. It is a convenient option for users who want to ensure encryption at rest with minimal effort in managing encryption keys.

A is correct option

Answer is C Details are on this link below: https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html Amazon S3 buckets have bucket encryption enabled by default, and new objects are automatically encrypted by using server-side encryption with Amazon S3 managed keys (SSE-S3). This encryption applies to all new objects in your Amazon S3 buckets, and comes at no cost to you. If you need more control over your encryption keys, such as managing key rotation and access policy grants, you can elect to use server-side encryption with AWS Key Management Service (AWS KMS) keys (SSE-KMS), or dual-layer server-side encryption with AWS KMS keys (DSSE-KMS). For more information about SSE-KMS, see Specifying server-side encryption with AWS KMS (SSE-KMS). For more information about DSSE-KMS, see Using dual-layer server-side encryption with AWS KMS keys (DSSE-KMS).

Should be option A

option B is the correct answer with least operational overhead on admins

option A (Create a customer managed key. Use the key to encrypt the EBS volumes) is the most suitable option with the least operational overhead for the given requirements.