Encryption at Rest with KMS
Compliance requires that EBS volumes and S3 objects are encrypted at rest, that the security team controls who can use the key, and that every use of the key is auditable. What should you use?
Choose one answer
HTTPS on every endpoint so that data is always encrypted.
Security groups that block all traffic to the volumes and the bucket.
A customer managed AWS KMS key, used for EBS encryption and SSE-KMS on S3, with access controlled by its key policy.
An encryption key stored in each application's environment variables.