A city open-data portal stores non-sensitive public datasets beside confidential case files in separate S3 buckets. Security wants default encryption that matches classification. Which approach is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Not every box in the warehouse needs the same padlock. Open data can use SSE-S3; confidential buckets deserve SSE-KMS so you control and audit the keys. Turning encryption off or public-reading everything ignores classification.
Full Explanation
Matching encryption strength to data classification is a core data-security design choice. SSE-S3 is often sufficient for non-sensitive open data, while SSE-KMS provides customer-managed key policies, separation, and richer audit for confidential content. Disabling encryption, public ACLs on sensitive data, or homemade obfuscation are not appropriate substitutes.