Open-data park assets need simple server-side encryption, while regulated PHI attachments need customer managed keys with CloudTrail-visible key use. How should developers choose?
Select an answer to reveal the explanation.
Short Explanation
SSE-S3 is the simple city lockbox for open-data photos; SSE-KMS with a CMK is the sealed vault with a badge reader that CloudTrail can see. PHI wants the auditable CMK path. Turning encryption off to quiet logs is not a security strategy.
Full Explanation
SSE-S3 encrypts objects with Amazon S3 managed keys and is often sufficient for non-sensitive open-data assets. SSE-KMS with a customer managed key provides stronger key-control and records KMS API usage in CloudTrail, which regulated PHI attachments typically require. Client-side encryption is a different control and is not required for every municipal bucket; disabling encryption is incorrect.