AWS Certified Data Engineer Associate DEA-C01 Practice Question

The correct approach is to place a single customer-managed KMS key in the Security account and share it. A key-policy statement that gives the application-account roles kms:Encrypt, kms:GenerateDataKey*, and kms:ReEncrypt* lets them upload and encrypt objects but withholds kms:Decrypt, so they cannot read the data. A bucket policy that denies uploads unless the specific key ARN is supplied ensures every object is protected by that key. Analysts in the Security account keep Decrypt permission, so only they can access the contents. This centralizes rotation, auditing, and permission management to one key.

Creating separate keys in every application account increases operational burden and would still give those accounts decryption capability. Using the AWS managed key (aws/s3) is unsupported for cross-account access, so objects would be unreadable. SSE-C requires each team to manage its own client-side keys; because S3 never stores those keys, the Security account could not decrypt the uploads.