EBS / RDS / S3.
For most regulated workloads (PCI-DSS, HIPAA, GDPR-sensitive
data), encryption at rest is required. On AWS, the simplest correct
default is:
A) Build your own encryption library.
B) Enable AWS-managed encryption (SSE-S3 / SSE-KMS for S3, encrypted
EBS volumes, encrypted RDS instances) — and use customer-managed
KMS keys when you need full key lifecycle control.
C) Encryption at rest is unnecessary if the network is "trusted".
D) Store everything in plaintext for performance.Sign in to save your code and track progress across devices.
