Answer two questions about who must control the keys and where encryption should happen. The lab recommends SSE-S3, SSE-KMS, SSE-C, or Client-Side and draws who holds the key and where your plaintext exists.
1 — Who must hold and control the keys?
2 — Where does encryption happen?
SSE-S3
AWS holds the key and does the crypto. Simplest option.
AWS (S3)
Key held by
AWS / S3
Crypto happens at
S3
Plaintext reaches
Ready. Adjust the toggles above to see the recommendation change.