What's changed: Deepened SCS-C02 Chapter 5 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
5.3Protecting Storage and Database Data
Understand protecting stores—S3 encryption (SSE-S3/SSE-KMS/DSSE), S3 public-access block/bucket policies, EBS/RDS encryption, backup protection, and data lifecycle. Store data securely.
Protect data stores with encryption and access control. S3 public-access prevention and encryption choices are especially common.
5.3.1Store protection
- S3 encryption: choose from SSE-S3 (AWS-managed)/SSE-KMS (CMK, auditable)/DSSE (double).
- S3 public-access prevention: prevent accidental exposure with Block Public Access + restrictive bucket policy.
- EBS/RDS encryption: KMS at-rest encryption (snapshots encrypted too).
- Backup protection: prevent tampering/deletion with a separate account/region + WORM.
Common on SCS-C02: audit/control S3 keys = SSE-KMS, prevent accidental exposure = Block Public Access + bucket policy, EBS/RDS at-rest = KMS (incl. snapshots), backups in a separate account + WORM. Prevent S3 exposure by enabling Block Public Access at the account level.
SCS-C02 store protection probes "choosing encryption methods and access control, especially S3 exposure prevention." S3 encryption options: SSE-S3 (AWS-managed key, free, simple), SSE-KMS (control keys via CMK, audit usage in CloudTrail, S3 Bucket Keys cut cost), DSSE-KMS (double encryption for high regulation), and client-side encryption. If key control or audit is required, SSE-KMS is the answer. For exposure prevention, enable Block Public Access (BPA) at the account and bucket level to disable public ACLs/policies, plus a least-privilege bucket policy, VPC endpoint policies to limit sources, and disabling ACLs (bucket owner enforced) as the current best practice. EBS/RDS use KMS for at-rest encryption, with snapshots of encrypted volumes also encrypted and re-encryptable with a different CMK on cross-region copy. Backups via AWS Backup copy to a separate account/region with Backup Vault Lock (WORM) for ransomware/accidental-deletion resilience. Classify data with Macie and manage retention with lifecycle. The key is to correctly choose SSE-KMS when audit is needed, BPA + bucket policy + ACL disablement for exposure, KMS for EBS/RDS (incl. snapshots), and a separate account + WORM for backups.
| S3 encryption | Key management | When to use |
|---|---|---|
| SSE-S3 | AWS-managed (invisible) | Simple/free; no audit/control needed |
| SSE-KMS | CMK control; CloudTrail audit | Key control/audit required |
| DSSE-KMS | CMK; double encryption | High regulation; layered |
| Client-side | You manage keys | Never send plaintext to AWS |
Scenario: Store sensitive data in S3—prevent accidental exposure org-wide, audit key usage, and prepare for ransomware. → Enable Block Public Access at the account and bucket level and disable ACLs (bucket owner enforced), restricting via a least-privilege bucket policy. Encrypt with SSE-KMS (CMK) and audit usage in CloudTrail, and Deny aws:SecureTransport: false to enforce TLS. Back up with AWS Backup copied to a separate account/region + Vault Lock (WORM) for ransomware resilience.
FAQ: SSE-S3 or SSE-KMS? If encryption suffices and you need no key control/audit, use SSE-S3 (AWS-managed, free, simple). If you want to audit key usage in CloudTrail, control usage via key policy, or share keys cross-account, use SSE-KMS (CMK). For high-volume access cost, S3 Bucket Keys reduce KMS calls. When the requirement is "audit/control," choose SSE-KMS.
Exam trap: Relying on bucket policy alone to prevent S3 exposure is weak—a misconfigured policy can expose data. Enable Block Public Access (account and bucket) and disable ACLs (bucket owner enforced) for certainty. Also, choosing SSE-S3 when you "want to audit key usage" is wrong—audit/control needs SSE-KMS (CMK). Keeping backups only in the same account is insufficient for ransomware (use a separate account + WORM).
5.3.2Section summary
- S3 = SSE-KMS (auditable) + Block Public Access
- EBS/RDS = KMS encryption / backups = separate account + WORM
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. For S3 object encryption, you want to control the key and audit access via CloudTrail. Which method?
Q2. Reliably prevent S3 buckets from being accidentally public account-wide. What?
Q3. Encrypt an EBS volume and its snapshots at rest. What?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.