AWS Certified AI Practitioner AIF-C01 Practice Question

Server-side encryption with Amazon S3-managed keys (SSE-S3) automatically encrypts each object with a unique data key, and Amazon S3 transparently generates, stores, and rotates both the data keys and the key-encrypting keys. Because all keys are fully managed by AWS, customers do not create, rotate, or define policies for them, making SSE-S3 the simplest way to achieve encryption at rest for data such as AI training datasets.

Client-side encryption and SSE-C both require customers to supply and track their own keys with every request. SSE-KMS uses AWS KMS keys; customers can allow Amazon S3 to use the default AWS-managed key (aws/s3) or specify a customer-managed KMS key. When customer-managed keys are used, tasks such as key rotation, policy configuration, and access auditing fall to the customer, so SSE-KMS involves more administration than SSE-S3.