You want to encrypt objects stored in an S3 bucket with KMS keys that you manage yourself, rather than AWS-managed encryption keys. Which encryption method is the most appropriate?

Explanation

With SSE-KMS, you can perform server-side encryption of S3 objects using AWS KMS keys. Using a customer managed key gives you control over key management.

Per-choice explanations

Practical Use

S3 server-side encryption comes in three types: SSE-S3 (S3 managed keys), SSE-KMS (AWS KMS managed keys), and SSE-C (customer-provided keys). When you want to use self-managed KMS keys (customer managed KMS keys / CMKs), choose SSE-KMS, and use the KMS key policy to finely control which IAM principals can encrypt and decrypt. Combined with CloudTrail, you can also obtain an audit trail of who used the KMS key for encryption and decryption and when, which makes it suitable for business data storage with compliance requirements. SSE-KMS also has trade-offs. Because KMS APIs (Decrypt / GenerateDataKey) are called on every access to an S3 object, in workloads with many S3 requests the KMS request charges add up. The S3 Bucket Keys feature mitigates this by letting S3 reuse a bucket-level data key locally and significantly reducing the number of calls to KMS (in some cases reducing cost by up to about 99%). Using the default SSE-S3 or the AWS managed KMS key (`aws/s3`) keeps management minimal, but choose a customer managed CMK when you need strict control over key rotation or cross-account sharing. On SAA-C03, SSE-KMS is the correct answer in contexts such as "encrypt S3 with self-managed encryption keys" or "compliance requirements demand KMS auditing." Distractors include no encryption and Transfer Acceleration (a transfer speedup feature unrelated to encryption). The difference between SSE-S3 and SSE-KMS, cost optimization with Bucket Keys, and auditing via CloudTrail integration are also asked on higher exams.