AWS Certified Data Engineer Associate DEA-C01 Practice Question

Using SSE-KMS with a customer-managed key satisfies the requirement for encryption at rest while avoiding the default aws/s3 key. Setting bucket default encryption to that customer-managed key ensures every object written by the Glue job is encrypted without code changes. The key policy for the customer-managed key can grant decrypt permission to the external AWS accounts, and the bucket policy grants object access, so no per-object ACLs or manual key distribution are needed. SSE-S3 lacks customer control of keys. Client-side encryption adds significant key-management overhead. The aws/s3 managed key is explicitly disallowed by the security team and cannot be shared cross-account directly.