CCNA Data Protection Questions

Modifying the KMS key policy is the correct approach because the key policy is the resource-based policy that directly controls which principals can call kms:Decrypt on the CMK. By explicitly listing only authorized IAM roles as principals with Decrypt permission, you ensure that even if an S3 bucket policy or object ACL grants read access to ciphertext, those roles cannot decrypt it without the key. This is a robust data protection strategy because it combines S3 access control with KMS key-level authorization.

This is the officially supported AWS method for adding encryption at rest to an existing unencrypted RDS instance. You take a manual snapshot, copy that snapshot while specifying a KMS key (which encrypts the snapshot copy), and then restore the encrypted snapshot to a new DB instance. The restored instance is encrypted at the storage layer, and you can repoint your application to its new endpoint before decommissioning the original instance. After creation, encryption on that restored instance cannot be disabled.

To retrieve credentials dynamically, the application must use the Secrets Manager API to fetch the secret at runtime. This requires code changes to call GetSecretValue and appropriate IAM permissions for the EC2 instance role to access the secret. This approach eliminates hardcoded credentials and allows automatic rotation to take effect without application changes.

SSE-KMS integrates Amazon S3 with AWS Key Management Service to perform server-side encryption using envelope encryption: S3 calls KMS to generate a data key, encrypts the object with it, and stores the encrypted data key alongside the object. It supports customer-managed KMS keys, enabling granular access control through IAM and KMS policies, automatic key rotation, and audit logs via CloudTrail. This makes it particularly suitable for sensitive data requiring separation of duties and compliance traceability, though it is only one of several valid S3 server-side encryption options.

This is the correct condition because it explicitly requires the s3:x-amz-server-side-encryption header to carry the value aws:kms. In a bucket policy, a Deny with this condition rejects any PutObject call that is not using SSE-KMS, thereby enforcing KMS encryption on all stored objects. It targets the encryption mode directly and avoids the ambiguity of key-ID or source-based checks.

Automatic key rotation is a feature of AWS KMS customer managed keys that rotates the backing key material annually while retaining the same key ID and ARN. Applications continue to use the same key identifier, and AWS KMS automatically uses the new material for new encryption operations. This meets the requirement for transparent yearly rotation without application changes. The rotation is managed by AWS KMS and requires no additional infrastructure.

Creating a CloudHSM cluster with at least two HSMs in different Availability Zones ensures that if one HSM or AZ becomes unavailable, the other HSM can continue serving cryptographic operations. CloudHSM automatically synchronizes users, keys, and policies across all HSMs in the cluster, so the remaining HSM has the same key material. This architecture provides redundancy, high availability, and aligns with AWS recommended best practices for CloudHSM. Hence, it is the correct answer for improving durability/availability while keeping the HSM-based control.

Enabling default encryption on the bucket with SSE-S3 or SSE-KMS ensures every object placed in S3 is automatically encrypted at rest, even if the client does not send an encryption header. SSE-S3 uses AES-256 managed by AWS, while SSE-KMS uses envelope encryption with a customer-managed KMS key, giving you auditability, key rotation, and fine-grained access control. This is the simplest baseline measure to satisfy typical encryption-at-rest requirements for a new S3 data protection strategy.

Enabling automatic rotation in Secrets Manager with a 30-day interval is the correct managed solution. Secrets Manager schedules the rotation, invokes the configured Lambda rotation function, and coordinates the change of the database password with the secret's version lifecycle using AWSCURRENT and AWSPREVIOUS staging labels. You simply choose the rotation interval, and the service handles all scheduling, retries, and permissions, providing the lowest operational overhead. This also works with common database services like RDS via the built-in rotation templates.

The AWS Encryption SDK encrypts objects on the EC2 instance before upload, so plaintext never reaches S3 and keys remain outside AWS's control. This satisfies the stem's client-side encryption requirement for data at rest in S3.

Using HTTPS endpoints for S3 API calls means every request and response is encrypted with TLS, preventing attackers from reading or tampering with data in transit between an EC2 instance and S3. All AWS SDKs and the AWS CLI are configured to use HTTPS by default when sending S3 operations, and S3's TLS endpoints provide server authentication via AWS-managed certificates. This is the correct, native mechanism to meet the data-in-transit protection requirement for EC2-to-S3 communication.

Enabling automatic key rotation on a customer managed key lets AWS KMS rotate the backing key material annually without changing the key ID or ARN, so existing ciphertext and applications continue working. This satisfies the yearly rotation requirement.

AWS KMS is a fully managed service for creating and controlling the encryption keys used across AWS services, and it natively integrates with Amazon S3 through SSE-KMS. You can create a customer managed key, define key policies and grants, set automatic annual rotation, and control access via IAM policies and key conditions. With envelope encryption, KMS protects each S3 object with a unique data key that is encrypted by your KMS key, allowing you to centrally manage, monitor, and revoke the master key while still receiving CloudTrail logs for every decrypt operation.

CloudHSM provides a dedicated HSM, offloading encryption.

Enabling encryption at rest on the RDS instance protects data files and automated backups using AWS KMS-managed keys, addressing the at-rest requirement. Setting rds.force_ssl=1 in the DB parameter group configures the MySQL/PostgreSQL engine to accept only TLS/SSL-encrypted connections, forcing all clients to negotiate an encrypted transport. Applying this parameter group requires a reboot, and after that every connection—including from read replicas—must use SSL, thereby satisfying both at-rest and in-transit encryption.

Restoring a DB instance from an encrypted snapshot creates a new instance that is automatically encrypted using the KMS key that encrypted the snapshot. This process preserves the data while transferring encryption settings to the restored instance, making it a valid method for both new deployments and migrations from existing encrypted data. You may optionally choose a different customer-managed key during the restore, but encryption is guaranteed to be enabled.

SSE-S3 (Server-Side Encryption with Amazon S3-managed keys) encrypts each object using AES-256 with a unique key, and that key is then protected by a regularly rotated master key owned by S3. When enabled, S3 automatically encrypts data as it writes to disk and decrypts it transparently on retrieval, with no additional key management burden for the customer. This is a fully managed, low-overhead method for encrypting data at rest in S3.

This is the correct permission needed to upload any object to S3, regardless of whether server-side encryption is enabled. When using SSE-S3, S3 automatically encrypts the object with a unique key that is itself wrapped by a master key managed by S3, all happening transparently in the service. The caller only needs the standard s3:PutObject permission; no separate KMS or encryption-specific permissions are required for the upload to succeed with encryption.

The AWSServiceRoleForRDS service-linked role is a predefined IAM role that gives RDS the ability to call AWS services, including KMS, on your behalf for tasks such as encrypting and decrypting database storage. When this role is missing, RDS cannot assume it to perform kms:Encrypt, kms:Decrypt, or kms:GenerateDataKey operations, causing failures when you create, modify, or start an encrypted instance. This is the root cause in this scenario; you can verify or create the role with the AWS CLI command aws iam create-service-linked-role --aws-service-name rds.amazonaws.com.

Enabling EBS encryption by default in the Region is the easiest and most reliable method because it instructs the EC2 service to always encrypt newly created volumes and snapshots at the storage layer. When enabled, every new EBS volume and every new snapshot is encrypted with your default AWS KMS key (either the aws/ebs managed key or a customer-managed key you designate). This setting applies to all volumes created in that Region, including root volumes launched from unencrypted AMIs, without requiring you to modify applications or remember to check an encryption box.

This policy uses a Deny effect with a condition that checks for the presence and value of the s3:x-amz-server-side-encryption header. If a PutObject request does not include the header with aws:kms, the request is denied. This enforces encryption with SSE-KMS for all uploads. It is the standard way to require a specific encryption method for objects uploaded to an S3 bucket.

The wrong options are eliminated because this is a Decrypt event: a user invoked the KMS Decrypt API to reveal plaintext from previously encrypted data. In an investigation, this event is significant because it shows the KMS key was used to turn ciphertext into plaintext, which is how an attacker or insider would access data after exfiltrating it. Therefore, this interpretation correctly matches the CloudTrail record and indicates a potential data disclosure.

Enabling CloudTrail with data events for an S3 bucket records object-level operations such as GetObject, PutObject, DeleteObject, and HeadObject, capturing the IAM principal, source IP, and whether the request succeeded or failed. This creates an authoritative, queryable audit trail that can be searched in CloudTrail Lake or Athena and is essential for incident investigation, compliance reporting, and detecting compromised credentials. Unlike server access logs, CloudTrail data events reliably include failed attempts.

IAM policies are the primary identity-based access control in AWS. They allow you to grant specific principals, such as IAM users or roles, explicit Allow or Deny permissions for S3 actions on a given bucket and its objects. When combined with resource-based bucket policies, IAM enables fine-grained authorization, such as requiring s3:GetObject only for certain prefixes, which directly prevents unauthorized access to sensitive data.

A KMS key policy is a resource-based policy that defines which principals may use that key, and it must explicitly grant the decrypt permission to John. Even with admin IAM permissions, if John isn't listed as a principal in the key policy, AWS KMS denies the decryption call with AccessDenied. The correction is to add John as a principal with kms:Decrypt action in the key policy or configure the key policy to allow IAM policies, then keep his IAM permission.

An instance profile delivers temporary, automatically rotated credentials to the EC2 instance through the instance metadata service, so no long-term access keys are stored on disk. The attached IAM role scopes S3 permissions precisely, satisfying the requirement to avoid embedded credentials.

AWS managed keys are KMS keys created automatically when a service first needs encryption, and Amazon RDS's AWS managed key (alias aws/rds) has automatic rotation enabled by default, rotating the backing key material every year. Because the key is managed in the AWS account's service space, you cannot disable rotation, which neatly matches a requirement for guaranteed automatic rotation without any administrative action.

The AWS Encryption SDK uses envelope encryption: it generates a data key, encrypts the file with that data key, and encrypts the data key with the KMS customer managed key. Only the small data key is sent to KMS, minimizing data transfer. The encrypted file and encrypted data key are stored together. This meets the requirement to minimize data sent to KMS.

A bucket policy can enforce server-side encryption by using the request header condition keys `s3:x-amz-server-side-encryption` and `s3:x-amz-server-side-encryption-aws-kms-key-id`. For instance, a `Deny` statement with `StringNotEquals` on `s3:x-amz-server-side-encryption` for `aws:kms`, combined with a `Null` condition that denies uploads where the header is absent, will reject every `PutObject` and `InitiateMultipartUpload` that does not specify SSE-KMS. This is a direct, request-time enforcement mechanism.

This is the correct approach because AWS KMS custom key stores let you create a CMK whose key material is stored in a CloudHSM cluster that you fully control. When you enable RDS encryption at rest, RDS uses this CMK to encrypt the storage, and the key material never leaves your HSM. This gives you the dual benefit of RDS-native transparent encryption and the cryptographic ownership of an HSM, satisfying the data protection strategy.

AWS CloudTrail captures every KMS API request as a management event, including kms:Encrypt, kms:Decrypt, and kms:ScheduleKeyDeletion, and delivers those logs to an S3 bucket. You can then define a CloudWatch Logs metric filter on the JSON field of the CloudTrail event to match a specific KMS action, and attach a CloudWatch Alarm to that metric to trigger an SNS notification. This combination provides the required trackable, alertable audit trail for KMS API calls made when S3 encrypts objects using customer-managed KMS keys.

AWS CloudTrail is the authoritative source for KMS API activity because it records KMS calls as data events, including Decrypt, Encrypt, GenerateDataKey, and ReEncrypt. Each KMS data event in CloudTrail includes the key ID, whether decryption succeeded, the principal and ARN of the caller, the source IP, and the request timestamp. By enabling CloudTrail data events for a customer-managed KMS key, you get a complete audit trail that you can search in Athena or deliver to CloudWatch Logs for alerting.

In the client-side encryption envelope scheme, the SDK creates a one-time data key, encrypts the object with it, then wraps that data key with a KMS customer master key. The resulting encrypted data key is stored in the S3 object's metadata, for example the x-amz-meta-x-amz-key-v2 attributes, so a decrypter can later retrieve it and unwrap it to get the plaintext data key. Without this metadata, the ciphertext cannot be decrypted, so this storage step is a required part of client-side encryption.

This policy correctly denies S3 actions when aws:SecureTransport is false, meaning it blocks all HTTP requests that do not use TLS. The aws:SecureTransport key is true only for requests made over HTTPS, so this conditional deny rejects any insecure request while allowing encrypted traffic. This is the AWS-recommended bucket policy pattern for enforcing encryption in transit and satisfies the requirement.

S3 server access logs capture every request made to the bucket, including requester IP, IAM role/user, action, and HTTP status, providing a detailed audit trail for forensic analysis. Amazon GuardDuty's S3 protection continuously monitors object-level operations and uses threat intelligence and anomaly detection to flag suspicious patterns, such as mass downloads or access from unusual geographies, in near-real time. Together they deliver both historical evidence and proactive alerting, making this the only option that addresses both detection and investigation of unauthorized access.

AWS CloudHSM supports taking point-in-time backups of an entire cluster, and those backups can be copied to other regions using the CopyBackupToRegion API or the console. After copying, you restore the backup in the destination region to create a new cluster that contains all original keys, HSMs, and settings. This preserves FIPS 140-2 validated protection because key material never leaves the HSM boundary, and it is the officially supported method for cross-region disaster recovery.

Account-level S3 Block Public Access is a set of controls (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets) that act as a centralized guardrail across every bucket in the AWS account. When enabled, it overrides any bucket policy, owner policy, or object ACL that would grant public access, and it blocks both existing public grants and future attempts to make objects or buckets public. This is the most comprehensive control because it applies even if a developer mistakenly attaches a permissive bucket policy or uploads an object with a public-read ACL.

Enabling SSL/TLS on the RDS instance forces the database server to accept only encrypted connections, typically by setting the force_ssl parameter (for PostgreSQL) or the SSL/TLS requirement (for MySQL) in the DB parameter group. The application must then connect using TLS with the RDS-generated CA certificate in its trust store, and it should enforce certificate verification to prevent man-in-the-middle attacks. This encrypts all data in transit between the EC2 instances and the RDS endpoint, satisfying the confidentiality requirement with minimal latency overhead and without needing extra networking equipment.

The bucket policy contains a Deny statement targeting all S3 actions and keyed on the Bool condition aws:SecureTransport=false. Requests made with HTTP set this key to false, so the condition evaluates true, the Deny is applied, and the PutObject upload is rejected. Only HTTPS requests would have SecureTransport=true and therefore would not match this particular Deny; however, an explicit Allow statement is still required to authorize the request.

Creating a symmetric KMS key in a CloudHSM-backed custom key store with key usage set to ENCRYPT_DECRYPT ensures that the key material is generated and used only inside the customer's dedicated HSM cluster. The HSM performs all encryption and decryption operations for that key, and the unencrypted key material never leaves the HSM or becomes visible to AWS KMS service processes. This satisfies both the HSM residency requirement and the need for a general-purpose data encryption key.

To encrypt data in transit, you must configure the database client and server to negotiate a TLS session. On RDS, this means importing the Amazon RDS CA certificate into the client's trust store and setting the database parameter group's `rds.force_ssl` (PostgreSQL) or `require_secure_transport` (MySQL/MariaDB) parameter to 1. Once enabled, TLS encrypts the entire database protocol stream, including authentication, query text, and result sets, and the client can verify that it is connecting to the genuine RDS endpoint, not an impostor.

AWS CloudTrail is correct because it records KMS API calls, including management-plane operations like CreateKey, ScheduleKeyDeletion, and PutKeyPolicy, and data-plane operations such as Encrypt, Decrypt, and GenerateDataKey when data events are enabled. When an S3 object encrypted with SSE-KMS is accessed, CloudTrail generates an event for the corresponding KMS Decrypt call, providing a complete audit trail of who used which key, when, and from what context. These logs can be delivered to an S3 bucket and optionally sent to CloudWatch Logs for alerting and forensic analysis, making CloudTrail the definitive service for KMS-related audit and compliance.

S3 Glacier Instant Retrieval provides millisecond access to backup files while offering a lower storage price than S3 Standard-IA, making it both fast and cost-effective for backups that must be available immediately. Using SSE-S3 for encryption adds no per-object or per-API charges, so you satisfy the server-side encryption requirement without increasing the cost of the solution. This combination directly meets the stated need for instant retrieval and economical long-term storage.

Amazon Macie is purpose-built to discover, monitor, and classify sensitive data stored in Amazon S3 using machine learning and built-in managed data identifiers such as personally identifiable information (PII), financial data, and credentials. It automatically inventories buckets, evaluates object-level risk, and generates actionable findings/alerts when sensitive data is detected. This makes Macie the correct answer for automatically discovering and classifying sensitive customer data.

Changes default encryption to SSE-KMS.

Take a manual snapshot of the unencrypted DB instance, then use the AWS CLI or console to copy that snapshot into a new snapshot encrypted with a KMS key (for example, with the copy-db-snapshot command and a --kms-key-id parameter). Once the encrypted snapshot is available, restore a new DB instance from it. The restored instance inherits the encrypted storage from the snapshot, and after updating the application connection string to the new endpoint, the original unencrypted instance can be decommissioned.

The bucket policy condition requires the aws:kms encryption algorithm, but the request specifies AES256. Since the header value fails the condition, S3 rejects the PutObject call with an access denied error rather than storing the object.

Enabling SSL/TLS encrypts the wire protocol between the EC2 client and the RDS endpoint, directly satisfying the in-transit encryption requirement. RDS supports TLS via certificate-based handshake, so the connection itself is protected regardless of storage-level encryption. This is the only option addressing data moving across the network.

AWS Direct Connect with an IPsec VPN layers an encrypted VPN tunnel over a dedicated, private Direct Connect connection, giving you both isolation from the public internet and traffic confidentiality. The IPsec protocol authenticates and encrypts the packets, ensuring that data is protected in transit while still benefiting from the predictable latency and throughput of the physical link. This is the recommended pattern when you need both dedicated bandwidth and encryption.

AWS Identity and Access Management enforces authentication and authorisation through policies, satisfying the stem's requirement that only authorised users access S3 objects. It provides the permission boundary, while a logging service supplies the audit trail of that access.

Under SSE-C, the customer must provide the encryption key in the headers of every S3 request, such as x-amz-server-side-encryption-customer-key. S3 uses that key to encrypt the object at write time and to decrypt it at read time, then discards the key after the request completes. Because the key is never stored by AWS, it must be supplied again for each upload, download, or header retrieval.

The AWS managed key for EBS (aws/ebs) is a KMS key that AWS creates and manages in the customer's account, and AWS KMS automatically rotates it once per year. Because EBS volumes can use this key by default and no customer action is required for rotation, it satisfies the requirement for automatic rotation. This is the key type that the question is asking to identify.

AWS Direct Connect with VPN is the correct combination because Direct Connect gives you a dedicated, private network connection that bypasses the public internet, offering consistent latency and bandwidth. Since Direct Connect alone does not encrypt your traffic, the VPN overlay (typically IPsec) is added to encrypt data in transit over that private connection. This pairing satisfies both explicit requirements: a dedicated transport path and encryption for all data between the on-premises environment and AWS.

SSE-KMS with a customer-managed key gives you independent control over the CMK, including the ability to set key policies, grant and revoke permissions, and force rotation. With CloudTrail for KMS enabled, every Decrypt, GenerateDataKey, and ReEncrypt request against that key is recorded with the user, role, and principal ARN, directly tying each S3 object access to an auditable event. Customer-managed keys also let you align the key with your own governance model, and because the key is in KMS, you can use key policies to enforce conditions (such as VPC endpoints or MFA) and can respond to a breach by disabling the key to instantly block all future decrypt operations.

SSE-KMS (Server-Side Encryption with AWS KMS) instructs S3 to encrypt each object at rest using a customer managed KMS key, AWS managed KMS key, or AWS owned key. S3 calls KMS to generate a plaintext data key and an encrypted copy of that key, using envelope encryption to protect the object while maintaining the ability to rotate the KMS key independently. This gives you separation of duties, centralized key management, and auditability, making it a valid way to enforce at-rest encryption.

The kms encrypt API returns a CiphertextBlob, and the AWS CLI base64-encodes this binary field in its JSON output. The ciphertext is encrypted under the customer master key specified in the command, so the same KMS key can decrypt it by calling kms decrypt after base64-decoding the blob. This matches the actual behavior of the command and is therefore the correct answer.

The alternating users rotation strategy creates a second set of database credentials while the original remains valid, then promotes the new credentials to AWSCURRENT and demotes the old ones to AWSPREVIOUS. Applications can continue using either credential during the transition, so there is no window where no valid password exists. This makes it the right choice when a database cannot tolerate even brief downtime during Secrets Manager rotation.

Two separate deny statements ensure that an upload is denied if it lacks the correct encryption algorithm or if it uses a different KMS key. The first statement denies any upload not using aws:kms. The second denies any upload not using the specified key ARN. Together they enforce both requirements. This is the recommended approach in AWS documentation.

Creating a new CMK every 90 days and then updating the alias to reference the new key provides a stable abstraction because applications point to the alias, not the key ID. The alias update is immediate and atomic, requiring no application changes, restarts, or downtime; the old CMK remains enabled to decrypt data encrypted under previous keys. This pattern is the recommended AWS KMS approach for custom rotation periods and satisfies crypto-period separation.

The key policy scopes kms:Decrypt to calls whose encryption context contains department=finance. The decrypt request supplies a different encryption context, so the kms:EncryptionContext:department condition key does not match. As a result, the condition in the key policy is false and KMS denies the Decrypt operation. This is expected behavior: encryption context conditions are a way to limit key usage to specific data or workloads.

The KMS key policy acts as the resource-based authorization for the key and must explicitly grant the Amazon EFS service principal (elasticfilesystem.amazonaws.com) the kms:GenerateDataKeyWithoutPlaintext, kms:Decrypt, and kms:DescribeKey permissions. Without these grants in the key policy, EFS cannot create or use data keys to encrypt or decrypt the file system, even if the IAM principal has full EFS permissions. This is a mandatory, non-optional part of enabling EFS encryption at rest — the key policy is the authoritative control over which AWS services may use the CMK. Therefore, configuring the key policy correctly is a required action, not merely a best practice.

Deleting the CloudHSM backup from the backup service ensures that the copied encrypted key material that was exfiltrated cannot be restored to a new or existing HSM, eliminating the attacker's ability to recover the keys. After that, rotating every key that was stored in the HSM—generating new keys and re-encrypting data with them—renders any previously copied key material useless because the data is now protected by fresh keys. This two-step approach directly addresses both ways the compromise can be exploited: backup restoration and continued use of the old key material.

This is correct. SSE is a per-queue setting, so enabling it on the source queue does not automatically protect the DLQ. When a message is redriven, SQS decrypts it from the source queue and writes it to the DLQ using whatever encryption the DLQ has configured. If the DLQ has no SSE, the message is stored as plaintext, directly violating the company's requirement that messages be encrypted at rest.

The kms:ViaService condition restricts key usage to requests routed through S3, while the principal or ARN condition limits decryption to the named IAM role. Together they enforce least privilege, ensuring no other principal or direct KMS call can decrypt the bucket's objects.

This solution combines an explicit bucket policy deny with the s3:x-amz-server-side-encryption condition key to reject any PutObject that does not specify aws:kms as the encryption value, making enforcement happen before the write is committed. Because this is a request-level condition, it cannot be bypassed by client-side SDK settings or explicit SSE headers that differ from KMS. S3 Inventory then provides a periodic CSV or Parquet report of existing objects, including their encryption status, enabling the team to locate and remediate any legacy objects that predate the policy.

This bucket policy is correct because it uses an explicit Deny with a StringNotEquals condition to require that every s3:PutObject request includes the x-amz-server-side-encryption header set to aws:kms. Since explicit Deny statements override any Allow, any upload that lacks the header or uses a different encryption method is blocked, while requests that properly specify SSE-KMS are allowed. The absence of the header also makes StringNotEquals evaluate true, so the Deny also catches requests that omit encryption entirely, ensuring sensitive data is always encrypted with KMS-managed keys.

The correct cross-account configuration requires two resource-based policies that address separate authorization layers: the bucket policy must explicitly allow the external account's principal to call s3:GetObject on the object, and the KMS key policy must explicitly allow that same external principal to call kms:Decrypt. The bucket policy authorizes the S3 data-plane operation, while the KMS key policy authorizes the cryptographic operation that S3 performs on the requester's behalf. Without either policy, the request fails because the external account is not part of the key owner's account and cross-account access is denied by default.

PKCS#11 sessions on a CloudHSM are finite, and each session handle is valid only until C_CloseSession or C_Finalize is called. An application that fails to close sessions leaks them, and once the HSM client's session limit is reached, any handle retained from an evicted or expired session returns CKR_SESSION_HANDLE_INVALID on subsequent operations. This is the correct explanation: the root cause is session lifecycle mismanagement, not network or identity configuration, and the fix is to use try-with-resources or a session pool that guarantees C_CloseSession in all code paths.

For an SSE-C encrypted object, S3 does not store or possess the actual encryption key; it only stores a one-way HMAC-derived verification value. Accordingly, every GET request must include the `x-amz-server-side-encryption-customer-key` header, along with `x-amz-server-side-encryption-customer-algorithm` and optionally the MD5 header, so S3 can verify the key and decrypt the object. Omitting the key header in the GET causes S3 to return a 400 Bad Request because it cannot authenticate the customer-supplied key.

S3 Lifecycle policy with NoncurrentVersionExpiration defines how many days a previous version is retained after it becomes noncurrent. When a versioned object is deleted, S3 places a delete marker and the prior version is preserved as a noncurrent version; the lifecycle action permanently removes those noncurrent versions only after the specified number of days. This provides exactly the requested grace period for recovering deleted objects before they are eventually purged.

Configuring the client with SSL and the downloaded RDS CA certificate enables full certificate verification, authenticating the database endpoint and preventing man-in-the-middle interception. Encryption alone without verification would leave the connection vulnerable, so this satisfies the requirement for the most secure encrypted connection.

Enabling EBS encryption by default at the account or Region level is the simplest, AWS-native way to enforce encryption for all new EBS volumes. No per-volume configuration is required: every newly created volume and any snapshot copied from it is automatically encrypted with the account's default KMS key (AWS-managed or customer-managed). This setting does not retroactively encrypt existing unencrypted volumes, but it ensures all future data-at-rest is protected across the account.

KMS authorises access through both the key policy and IAM policies. If the key policy does not grant kms:Decrypt to Alice, the request is denied regardless of her identity-based policy, making the key policy the most likely cause.

MFA Delete is a bucket-level feature that, when enabled alongside versioning, requires a valid multi-factor authentication code before S3 will permanently delete an object version or change the versioning state. Even if an IAM policy grants s3:DeleteObject or s3:DeleteObjectVersion, the API call fails unless the x-amz-mfa header contains a valid code, adding an independent security layer. This specifically prevents accidental or malicious deletion by requiring physical possession of an MFA device, making it a direct and powerful control for data protection.

AWS Secrets Manager is purpose-built for this scenario, offering secure storage, fine-grained access policies, and automatic credential rotation via built-in integrations with services like Amazon RDS and Redshift. It also natively supports secret versioning and schedule-based rotation using Lambda, so database credentials can be refreshed without application downtime or manual intervention.