Protecting Data at Rest

Every S3 encryption option and the requirement each one satisfies, the four-layer S3 access decision and how to troubleshoot it, Object Lock and Vault Lock for WORM and integrity, and encryption for EBS volumes, file systems, and databases — including the snapshot-sharing rules.

Content current as of 2026-10.

Lessons

1. S3 encryption, option by option
2. The S3 access decision
3. Integrity and immutability
4. Volumes, file systems, and databases

Sources

• SCS-C03 exam guide — Content Domain 5 (task 5.2)
• Amazon S3 — protecting data with server-side encryption
• Amazon S3 — reducing the cost of SSE-KMS with S3 Bucket Keys
• Amazon S3 — Object Lock
• Amazon EBS — encryption