How to Encrypt S3 Data with Customer Managed Keys and Automatic Rotation Using SSE-KMS
A company stores sensitive financial data in Amazon S3. The company's security policy requires that all data be encrypted at rest using a key that the company creates and manages, with the ability to rotate the key annually. The company also needs an audit trail of when the key was used and by which AWS service. Which solution should the company use to meet these requirements?
Quick Answer
The answer is to use server-side encryption with AWS KMS customer managed keys (SSE-KMS). This solution directly meets the requirement to encrypt S3 data with customer managed key and automatic rotation because AWS KMS allows you to create and control your own customer managed key (CMK) and enables automatic annual key rotation with a single toggle, satisfying the security policy. Additionally, every use of the key is logged in AWS CloudTrail, providing the necessary audit trail of when the key was used and by which service. On the AWS Certified Cloud Practitioner CLF-C02 exam, this question tests your understanding of the difference between AWS managed keys, customer managed keys, and SSE-S3; a common trap is choosing SSE-S3, which lacks customer control and rotation, or SSE-KMS with an AWS managed key, which does not allow you to manage rotation. Remember the memory tip: "Customer managed key equals full control, annual rotation, and CloudTrail audit."
⚠ Common exam trap
Many candidates confuse SSE-S3's 'AWS managed' keys with customer managed keys, or assume SSE-C's customer-provided keys satisfy the 'create and manage' requirement, overlooking the need for annual rotation and audit trail capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use server-side encryption with AWS KMS customer managed keys (SSE-KMS).
SSE-KMS with a customer managed key (CMK) allows the company to create and manage its own encryption key, enable automatic annual key rotation via AWS KMS, and provides detailed CloudTrail audit logs of every KMS API call (e.g., Decrypt, GenerateDataKey) showing which AWS service or user used the key. This satisfies all stated requirements: customer-managed key, annual rotation, and audit trail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use server-side encryption with S3 managed keys (SSE-S3).
Why it's wrong here
SSE-S3 uses AWS-managed keys that cannot be rotated by the customer and do not provide a detailed audit trail of key usage via CloudTrail. While it provides encryption at rest, it does not meet the requirement for customer-managed key rotation and auditing.
When this WOULD be correct
A company needs server-side encryption at rest but has no requirement to manage the encryption keys or audit key usage; the security policy only mandates encryption with AWS handling key management.
- ✓
Use server-side encryption with AWS KMS customer managed keys (SSE-KMS).
Why this is correct
SSE-KMS with a customer managed key (CMK) allows the company to create, manage, and rotate the key. Key usage is logged in AWS CloudTrail, providing the required audit trail. This is the correct solution.
- ✗
Use server-side encryption with customer-provided keys (SSE-C).
Why it's wrong here
SSE-C requires the customer to supply the encryption key with each request, but Amazon S3 does not store the key. The customer must manage the key separately (e.g., rotation, storage), which does not align with the requirement to have S3 manage the key under the customer's control. Additionally, SSE-C does not provide built-in key rotation or integrated CloudTrail auditing for the key itself.
When this WOULD be correct
A company needs to encrypt data at rest in S3 but must maintain full control over the encryption keys and cannot use AWS KMS due to compliance or regulatory requirements, and does not need an audit trail of key usage.
- ✗
Use client-side encryption with an AWS KMS managed key.
Why it's wrong here
Client-side encryption encrypts data before it is sent to Amazon S3. The encryption key is managed by the client application, not by S3. While AWS KMS can be used as a key source, the encryption happens outside of S3, and the company is responsible for implementing encryption logic. This adds complexity and does not leverage S3's native server-side encryption capabilities.
When this WOULD be correct
A company needs to encrypt data before uploading to S3 and wants to use an AWS KMS managed key for client-side encryption, with no requirement for an audit trail of AWS service usage.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use server-side encryption with AWS KMS customer managed keys (SSE-KMS).Correct answer▾
Why this is correct
SSE-KMS with a customer managed key (CMK) allows the company to create, manage, and rotate the key. Key usage is logged in AWS CloudTrail, providing the required audit trail. This is the correct solution.
✗Use server-side encryption with S3 managed keys (SSE-S3).Wrong answer — click to see why▾
Why this is wrong here
SSE-S3 uses AWS-managed keys, not customer-managed keys, so the company cannot control key rotation or obtain an audit trail of key usage.
★ When this WOULD be the correct answer
A company needs server-side encryption at rest but has no requirement to manage the encryption keys or audit key usage; the security policy only mandates encryption with AWS handling key management.
Why candidates choose this
Candidates may confuse SSE-S3 with a managed encryption solution and overlook the specific requirements for customer-managed keys and audit trails.
✗Use server-side encryption with customer-provided keys (SSE-C).Wrong answer — click to see why▾
Why this is wrong here
SSE-C requires the customer to manage the encryption keys themselves, including key rotation and storage, and does not provide an integrated audit trail of key usage by AWS services.
★ When this WOULD be the correct answer
A company needs to encrypt data at rest in S3 but must maintain full control over the encryption keys and cannot use AWS KMS due to compliance or regulatory requirements, and does not need an audit trail of key usage.
Why candidates choose this
Candidates may think SSE-C satisfies the requirement for customer-managed keys and annual rotation, but overlook the need for an audit trail and the operational burden of managing keys outside AWS.
✗Use client-side encryption with an AWS KMS managed key.Wrong answer — click to see why▾
Why this is wrong here
Client-side encryption does not provide an audit trail of key usage by AWS services because encryption occurs before data reaches AWS, and AWS KMS is not used for server-side operations.
★ When this WOULD be the correct answer
A company needs to encrypt data before uploading to S3 and wants to use an AWS KMS managed key for client-side encryption, with no requirement for an audit trail of AWS service usage.
Why candidates choose this
Candidates may confuse client-side encryption with server-side encryption and think that using an AWS KMS managed key for client-side encryption still provides audit logs, but KMS audit logs only track API calls, not client-side operations.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A healthcare company stores sensitive patient data in Amazon S3. The company must comply with a regulation that requires encryption keys to be rotated automatically every 12 months. The security team also needs to use IAM policies to control which users and roles can decrypt specific S3 objects. Which encryption solution should the company use for the S3 objects?
medium- A.Server-side encryption with customer-provided keys (SSE-C)
- ✓ B.Server-side encryption with AWS KMS managed keys (SSE-KMS) using a customer managed key
- C.Client-side encryption using the AWS Encryption SDK
- D.Server-side encryption with Amazon S3 managed keys (SSE-S3)
Why B: SSE-KMS with a customer managed key is correct because it allows automatic key rotation every 12 months (configurable via the AWS KMS console) and enables fine-grained access control through IAM policies and key policies. This meets both the regulatory rotation requirement and the security team's need to control decryption of specific S3 objects.
Variation 2. A company has a compliance policy requiring that all data at rest in Amazon S3 be encrypted with a key that is automatically rotated every year. The company wants to manage the encryption keys themselves, maintain control over access policies, and have AWS handle the key rotation automatically. Which AWS service should the company use?
medium- ✓ A.AWS Key Management Service (AWS KMS)
- B.AWS CloudHSM
- C.AWS Secrets Manager
- D.AWS Certificate Manager
Why A: AWS KMS allows you to create customer managed keys (CMKs) with automatic annual rotation enabled. You retain control over key policies and access permissions, while AWS handles the rotation of the key material. This satisfies the compliance requirement for encrypted data at rest in S3 with automatic yearly key rotation.
Variation 3. A financial services company stores confidential transaction records in Amazon S3. The company's compliance policy requires that all data at rest be encrypted using encryption keys that are under the company's full control. The keys must be automatically rotated every year. The company also needs a detailed audit trail of when each key was used and by which AWS principal. Which combination of AWS service and key type should the company use to meet these requirements?
medium- A.Use Amazon S3 server-side encryption with customer-provided keys (SSE-C) and store the keys in AWS Secrets Manager with automatic rotation enabled.
- B.Use Amazon S3 server-side encryption with AWS managed keys (SSE-S3) and enable automatic key rotation.
- C.Use AWS CloudHSM to generate and store the encryption keys, and configure an AWS Lambda function to rotate the keys every year and log usage to Amazon CloudWatch Logs.
- ✓ D.Use AWS Key Management Service (AWS KMS) with a customer managed key and enable automatic key rotation.
Why D: AWS KMS with a customer managed key allows the company to maintain full control over the encryption keys, enable automatic annual rotation, and provides detailed CloudTrail audit logs for every key usage, including the AWS principal that made the request. This satisfies the compliance requirements for encryption at rest, key rotation, and audit trail.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.