A social media company is designing a platform that allows users to upload data, which is stored in Amazon S3. Users can upload data encrypted with a public key. The company wants to ensure that only the company can decrypt the uploaded content using an asymmetric encryption key. The data must always be encrypted in transit and at rest. Options:

The requirement for users to upload data already encrypted with a public key dictates a client-side encryption strategy. Server-side encryption options (SSE-S3, SSE-C, SSE-KMS) encrypt data after it arrives at S3. The scenario describes asymmetric encryption, where a public key encrypts and a private key decrypts. To ensure only the company can decrypt, it must control the private key. This is achieved using a customer-managed key, specifically an asymmetric key pair managed in a service like AWS Key Management Service (KMS). The company distributes the public key to users for encryption, while the corresponding private key remains securely under the company's control within KMS for decryption.

A. SSE-S3 is server-side encryption and uses symmetric keys managed by S3, not an asymmetric key pair controlled by the company.
B. SSE-C is also server-side encryption and uses a symmetric key that the client provides with each request, not an asymmetric key pair.
C. This option is less precise. While a symmetric data key is often used in client-side encryption (envelope encryption), the critical component enabling the required access control is the customer-managed asymmetric key.

1. AWS Key Management Service Developer Guide, "Asymmetric keys in AWS KMS": This guide explains the use case for asymmetric keys: "You can use the public key of an asymmetric KMS key to encrypt data outside of AWS KMS... To decrypt the ciphertext, you must call the Decrypt operation with the same KMS key." This directly maps to the scenario where users encrypt client-side and the company decrypts.

2. Amazon Simple Storage Service User Guide, "Protecting data using client-side encryption": This document defines the method: "Client-side encryption is the act of encrypting data before sending it to Amazon S3." This aligns with the requirement that users upload data that is already encrypted.

3. AWS Key Management Service Developer Guide, "AWS KMS concepts - AWS KMS keys": This section clarifies the nature of customer-managed keys as KMS keys in an AWS account that the customer creates, owns, and manages, which is necessary for the company to control the decryption capability.